Program Consultores hit by municipal ransomware

A ransomware attack against Program Consultores S.A. encrypted files and left its servers inoperable, according to a company statement cited in local coverage. The disruption spread to municipalities and communes in Córdoba and other Argentine provinces, where billing, fee collection and several digital procedures were interrupted.

What happened to Program Consultores’ infrastructure?

The company said the intrusion affected the server infrastructure hosting its platforms. In the statement cited by La Voz del Interior, Program Consultores also denied any leak or theft of sensitive databases. Other coverage added nuance to that point, saying there were no confirmed mass data leaks.

The scope of the incident showed up in several municipalities that rely on the provider for administrative and tax systems. La Voz del Interior said the outage reached about 250 municipalities across different provinces, although it presented that figure as a journalistic estimate rather than a single official count.

What services were affected in municipalities?

The outage hit the daily operations of local governments that use Program Consultores’ platforms to collect revenue and manage public procedures. According to local authorities and municipal statements cited by La Voz del Interior, billing, fee collection and part of the digital casework were stopped.

In Tanti, the municipality said the PROGRAM system was taken offline by a cyberattack, although Civil Registry and driver licensing services kept running. In Roldán, Santa Fe, the commune reported problems caused by an attack on its provider’s server, within the same episode that affected Program Consultores.

Villa Giardino, meanwhile, asked for proof of payments made between Oct. 17 and Oct. 26 to rebuild records affected by the system outage. In Villa de Merlo, according to El Corredor Noticias, the local government asked taxpayers to submit bills and payment receipts for taxes paid on Oct. 22 because those transactions may not have been recorded after the provider attack.

What is known about the ransom demand and the attack’s reach?

Some affected municipalities mentioned ransom demands of up to three bitcoin to unlock encrypted information on the servers, but La Voz del Interior presented that detail as an unconfirmed report. Later, El Ciudadano said the municipalities consulted and the company ruled out mass leaks and that there were no confirmed demands for million-dollar ransoms.

The same outlet added that Program Consultores may have filed a formal complaint with the Investigating Prosecutor’s Office, although the report did not identify a case number or publish the document. Identidad Correntina also repeated specialist Enrique Dutra’s assessment that the problems reached more than 24 localities, a figure that likewise does not amount to a consolidated official record.

Taken together, the reporting points to a broad impact on municipal operations, but the figures remain split between journalistic estimates, local reports and references that have not been independently audited.