Uruguay strengthens CERTuy and national SOC

CERTuy logged 14,264 incidents tied to threats or cyberattacks in Uruguay in 2024 and 42,768 in 2025, according to El País. The report also described two incidents that occurred about two months earlier, which a person interviewed by the newspaper attributed to alleged use of artificial intelligence to identify vulnerabilities, scan infrastructure, and generate tools that appeared to be legitimate monitoring programs.

How is Uruguay's state defense organized?

Uruguay has had a Security Operations Center managed by Agesic since 2017, and in 2019 it launched the Government Security Operations Center program with support from the Inter-American Development Bank, according to El País. The report added that CERTuy handles active monitoring, the deployment of a sensor network, event forwarding to the national SOC, threat intelligence, and threat hunting.

That institutional setup is paired with a regulatory framework that, according to Compliance Latam, gives Agesic authority to regulate, oversee, and audit information security in public entities and in private organizations tied to critical services or sectors. The same article said Law 19.670 requires immediate reporting of security breaches to the Personal Data Regulatory and Control Unit, which coordinates the response with CERTuy.

What reporting obligations does Uruguayan law set?

Uruguayan rules require cyber incidents to be reported to Agesic within 24 hours of detection, and Decree 66/025 made the Uruguay Cybersecurity Framework mandatory, aligned with the NIST Cybersecurity Framework, according to Compliance Latam. In addition, Law 20.327 added offenses such as computer damage, unlawful access, unlawful interception, and identity theft to the criminal code.

At the same time, the Compliance Latam article said Law 19.924 gives Agesic regulatory, oversight, and audit powers over information security in the public sector and among private actors linked to critical services or sectors. In that structure, coordination among Agesic, CERTuy, and the Personal Data Regulatory and Control Unit is the formal response axis for incidents.

What is known about the incidents reported by El País?

According to a person interviewed by El País, the incidents allegedly affected industrial control equipment and caused failures in different parts of those systems. The same source said the attackers supposedly used AI to detect vulnerabilities, scan infrastructure, and build tools that mimicked legitimate monitoring software.

The report does not allow those claims to be officially confirmed as a fully verified local case of generative phishing or deepfake use. It does establish that Uruguay is already operating with a response architecture that combines CERTuy, the national SOC, and legal obligations for rapid notification, while the number of incidents recorded by CERTuy kept rising between 2024 and 2025.