Cybersecurity radar on

Threat actor claims to sell 14.7 million records including DNI, CUIT and personal data.

Investigation opened after suspected leak of reserved information to Uruguayan drug trafficker Sebastián Marset.

Listed on dark web leak site on October 7, 2026.

Qilin group claims to have stolen data and plans to publish it in 9-10 days.

Intervention with seizure of 22 bank cards, 5 cell phones and 2 vehicles; case handled by Depincri Chosica-Chaclacayo.

Eclipse actor claims attack on Brazilian manufacturing company.

Alleged publication of about 11,000 records (180 MB) of customers and employees, including names, ID documents, contacts and salaries. Unverified.

Post denounces that photos taken for DNI are leaked within minutes to multiple doxing sites in Peru.

Sanctions for failures in anti-money laundering prevention, risk management and compliance at entities like Itaú, Atlas and Visión Banco.

State actors deployed tunneler malware across gov, finance & telecom in NA/Europe — dozens compromised.

Sensitive information leak and attacks against SSPC systems and Oaxaca C4/C5i infrastructure.

Enforcement action against Flax Typhoon infrastructure operated by China state-sponsored actors.

List includes CVE-2026-102255 SonicWall CVSS 10, CVE-2026-76482 Cisco, CVE-2026-104334 IBM Langflow.

CVE-2026-59347 and CVE-2026-59346 reported in VMware products.

147 kiosks offline since October 2. Fifth incident in Guanajuato institutions this year.

Actor Kazu publishes first 100 GB batch and threatens more every 48 hours until October 20.

Open directories exposed on Malaysian VPS with intrusion kit in state government network.

NightSpire group blog post indicates possible ransomware attack against the port company in Colombia.

PampaLeaks group (KOIII) offers databases from Argentine fintech and social security system.

Cybercrime channel ad offers alleged databases from SSPC, LOCATEL, Edomex, Baja California, SEP Puebla and other states.

Group Cyberagentsss posts on underground forum database with DNI, names, addresses and phones; status unconfirmed by authorities.

Threat actor dragonforce lists Petrosul Distribuidora, Transportadora e Comércio de Combustíveis Ltda. as victim on leak site.

Actor: nuevaeps. Threat of additional exposure of over 1 million records from Santander. Not officially confirmed.

Threat actor claims 29,018 records from Vaupés department allegedly from Nueva EPS; insurer states no evidence of unauthorized access found.

Unverified claim; no company confirmation.

Government strengthens critical infrastructure defense; CERT.AR exceeded 700 incidents.

Victim listed on the actor's dark web leak site.

Indicted for defrauding clients by falsely claiming to decrypt ransomware.

Threat actor S3r1aL_Br3aCh3R claims compromise of 630M+ records including student, employee, CPF and M365 accounts.

Reported data: names, dates of birth, sex, government identifiers, addresses and postal codes. Unverified status.

Group claims to have obtained data and intends to publish within 14-15 days. Financial services sector.

Actor tuiyin reported on underground channels; ~394k alleged records (RUT, emails, phones) unconfirmed by authorities.

Group claims to have obtained the organization's data and intends to publish it within 9-10 days. Energy & utilities sector.

FBI warns campaign remains active; ColCERT indicates 2,436 compromised interfaces and 27 confirmed organizations in Colombia.

Samples include DIGITEL, Apuestas Royal and INTT. Massive collections of records obtained with malware.

Incident confirmed by state government; threat actor unknown.

Claim by actors Frouzenx, Yar1ner, KerberusCroww and H3arth regarding data from gob.mx/jalisco.

Recommendations to verify stores, avoid advance payments and use secure platforms.

El Economista post and replications highlight The Gentlemen ransomware affiliate using AI programming assistant in compromised Mexican systems.

Users warn about scammer operating with fake account in Peru.

Seller claims 500,000 records with personal data for sale at $500.

Over 86 thousand devices affected in 194 countries. Password rotation insufficient.

Authorization vulnerability allowing authenticated attackers to read other users' mailboxes. Patch available.

At the Colombian Internet Governance Forum, CRC details measures against smishing, vishing and spoofing under Resolution 8308.

Post indicates the incident is already international news on leak portals.

Patches available but implants persist; CISA requires forensic triage. CVSS up to 9.5.

During the first half of 2026, more than 107,000 phishing attacks were recorded in the region using this format.

Builds 8.0.2, 7.6.7 and 7.4.9 updated. Path traversal flaw without authentication. Listed in CISA KEV.