Energy, Electricity and Utilities Critical Infrastructure

Active threats and campaigns

Ransomware and extortion

The month was dominated by ransomware, but the internal breakdown requires separating the typologies. Only four cases in the period clearly indicate confirmed asset encryption. There was one exfiltration case without encryption, one case mentioned only on a leak site, and eighteen situations where the source does not allow a precise determination of whether there was encryption, data theft, or only a public claim. That mix is typical of today’s extortion ecosystem, where attackers gain value through both pressure and ambiguity. In utilities, that ambiguity is dangerous because it can delay containment decisions, notifications, and talks with third parties.

Ecopetrol fits the exfiltration category, with controls that prevented encryption. Reuters reported a blocked ransomware attempt and unauthorized access to data. ITWareLatam reinforced the continuity-of-operations reading and said there was no system encryption. This is the kind of case that now dominates many campaigns against critical sectors, attackers obtain data, extract extortion value, and leave the operational layer intact to maximize pressure. The damage, then, is measured not only in downed systems, but also in compromised accounts, copied documentation, and downstream risks for group companies.

Oldelval represents another form of exposure. The TheGentlemen claim, the extortion tone on the leak site, and the company’s response suggest an incident aligned with double-pressure tactics, but the material does not allow a precise classification within the operational taxonomy. There is no confirmation of encryption or company-validated exfiltration. That lack of precision is not a flaw in the report, it is part of the month’s reality, many incidents reach public view before their real technical architecture is known. For a security team, that means the first hour of response should assume the worst reasonable case without taking the public mention as the end of the matter.

Sinop Energia sits in a similar zone, although with greater weight on the leak narrative. Trackers followed it as a victim and repeated the 300 GB figure, but the material does not include its own statement that would clearly separate simple extortion, a leak site case, or encryption. In threat terms, that still matters because the criminal business model depends on the rapid publication of victims and speculation about the scope of the leak. In energy operations, a rushed attribution can affect contracts, insurance, and trust relationships with customers and investors.

Fraud and phishing

This month’s material documents only one fraud or phishing case, and it is not concentrated in the energy vertical as a dominant campaign. That does not mean the vector is absent, only that it was not the focus of the verified July incidents. Even so, the data is useful because it shows that, in energy and utilities companies, the entry point is often email, identity, or third-party interaction. When the month is dominated by ransomware and leaks, phishing acts more as an access and persistence mechanism than as a standalone threat with its own narrative.

APT and hacktivism

Paraguay produced the most visible case of activity attributed to actors linked to the Chinese government against state systems. Although this is not an incident in the energy and utilities vertical, it does provide regional context on the intrusion climate and on institutional attention to sustained cyberoperations. MITIC told the Senate that information breaches were detected in 120 state institutions, and later a criminal investigation was mentioned by the Prosecutor’s Office. For the energy sector, the reading is not that there is a campaign specifically targeting Paraguayan utilities, but that the region is dealing with persistent actors capable of moving between state, corporate, and infrastructure targets.

Critical vulnerabilities

Hitachi Energy's alerts are the only vulnerabilities this month with a clear impact on the energy sector. The material does not show a large volume of confirmed exploitation in Latin America for these CVEs, but it does make clear that security teams in the sector should treat them as a priority. The risk chain is direct: insecure access, credentials, sessions, exposed consoles, and possible movement to more sensitive components if segmentation is weak. In OT environments, the problem rarely starts inside the PLC. It usually begins in the layer that manages, monitors, or connects.

Regulation and compliance

July showed no new documented regulatory moves in the period materials, at least not in the form of a rule, resolution, or formal compliance change specific to energy and utilities in Latin America. That zero should not be read as a lack of regulatory pressure, but as the absence of a normative move captured by the analyzed corpus. What did appear were signs of reactive compliance and corporate reporting that matter for the sector. Ecopetrol notified the SEC through a Form 6-K, and also reported actions before Fiscalía and MinTIC. In practice, that sets a high threshold for how formalized the event became.

The link between a cyber incident and regulatory disclosure became more visible in the region. When an energy company with significant operations and affected subsidiaries has to report to the U.S. market, the incident is no longer just technical. Materiality, corporate governance, and notification timing enter the picture. For other utilities in the region, the Ecopetrol case is a concrete reference point showing that legal and communications handling must be built into the response from the first phase. In an exfiltration event, the window between detection, validation, classification, and reporting can be just as sensitive as technical containment.

Countries and most affected subsegments

Colombia

Colombia had the month’s heaviest case, centered on Ecopetrol. The company confirmed the illegal publication of information from 15 companies in the group, reported access to about 3,300 accounts, and moved in parallel through corporate, judicial and regulatory channels. The Fiscalía opened an investigation, and local media tracked the case closely. This also comes against a backdrop of rising regional pressure on Colombian companies, although those aggregate figures are not part of this report’s monthly volume. The most exposed subsegment here is not energy in the classic sense alone, but the ecosystem of holding companies, subsidiaries, cloud services and vendors that supports operations.

Brazil

Brazil appeared through Sinop Energia and the broader regional ransomware context. The electric company case was linked to Global Secret Group and to a reported exfiltration of 300 GB. While the material does not provide independent corporate confirmation, it does show that the country remains a priority target in Latin America’s extortion ecosystem. For Brazilian utilities, the lesson is clear: brand reputation, a broad digital surface and dependence on vendors mean a leak site posting can quickly escalate into a communications crisis.

Argentina

Argentina appeared through Oldelval, with one key difference from other cases this month, the oil transport operation was not interrupted. According to the company, the incident affected administrative systems and was contained. For the pipeline and midstream subsegment, that leaves a useful takeaway. Physical continuity does not remove the need to review exposure in support systems, access to administrative platforms, user privileges and recovery processes. An incident that does not move crude today can open the door to the next one.

Paraguay

Paraguay did not record a confirmed energy-sector incident during the month, but it did present a climate of alert around compromises in state systems. Copaco proactively took down its website after detecting a security incident, with no confirmed impact on critical systems, and MITIC reported that information from 120 public institutions had been compromised, attributed to groups linked to China. For utilities and energy, this serves as regional context on cyber hygiene and digital infrastructure exposure, especially for organizations that share dependencies or vendors with the public sector.

Subsegments under the most pressure

Within the vertical, the most sensitive subsegment was integrated energy with heavy dependence on administration and data management, as seen in holdings and large operators. Next was hydrocarbon transport and logistics, exemplified by Oldelval. Finally, power generation and distribution were exposed through the visibility of Sinop Energia and the need to take Hitachi Energy industrial software alerts seriously. In all cases, the most fragile surface was not the isolated physical asset, but the digital ecosystem around it.

Trends and signals to watch

There is no month-over-month baseline, because this is the first archived period with this indicator format for Latin America. Even so, the material does identify signals that should remain under observation in the coming months. The first is ransomware becoming more firmly established as a mixed extortion method, with cases in which exfiltration carries more weight than encryption. The second is the growing weight of formal communications to regulators and markets, something visible in Ecopetrol. The third is the exposure of industrial software and energy platforms to high-severity vulnerabilities that can be used as a bridge to remote access or denial-of-service attacks.

The most sensitive area is the combination of leak sites and operational continuity. If a criminal group publishes data but does not take operations down, many organizations tend to underestimate the event. In utilities, that is a mistake. Operations may continue, but reputational, contractual, and legal damage is already underway. That pattern appears in Ecopetrol and, less conclusively, in Oldelval and Sinop Energia. The focus for August should be whether these campaigns continue to favor data theft over physical disruption, because that model is usually harder to detect in time and slower to eliminate.

The other signal is the significance of alerts about Hitachi Energy. This is not just a vendor, but a class of systems used to monitor and operate energy infrastructure. When CISA, WaterISAC, INCIBE and other agencies issue matching warnings about products of that type, the message for the region is that the risk is neither theoretical nor peripheral. The priority should not be limited to patching, but should include external exposure, segmentation, access accounts, logging and response capability in the event of remote exploitation.

Security team recommendations

First, split ransomware response into three operational tracks, confirmed encryption, exfiltration with operations intact, and a leak site mention without independent validation. Treating all three as the same leads to containment and communications mistakes. In energy and utilities, the difference between lost availability and lost confidentiality changes the decision chain. Technical, legal, and communications teams should work from the same taxonomy from minute one.

Second, strengthen identity hygiene and privileged access controls across administrative, cloud, and support environments. Ecopetrol showed that an intrusion can affect thousands of accounts and several subsidiaries without touching the operational core. That means reviewing MFA, account segregation, privilege reviews, session expiration, activity logging, and credential rotation across the corporate chain, not just in the OT bastion.

Third, audit environments using Hitachi Energy software and any similar industrial or energy management platform. Verify versions, remote exposure, segmentation, access lists, patching, and contingencies for application outages. The vulnerabilities reported in July are not only an IT issue: they can become a pivot path toward sensitive assets if management, telemetry, and operations are loosely integrated.

Fourth, review restoration capacity and backup quality with a focus on exfiltration scenarios. A healthy backup does not solve leakage or secret exposure, but it does limit operational pressure if the attacker escalates to encryption. In a critical operator, restore availability should be tested cold and hot, with measured times and real separation between administrative and operational copies.

Fifth, harden third-party management. The Ecopetrol material mentions data from multiple subsidiaries and the possibility of access through distributed corporate resources. That pattern requires a vendor inventory, review of temporary access, controls over administrator accounts, monitoring of service credentials, and testing of access revocation when the contractual relationship ends.

Sixth, prepare regulatory and public communications scripts before an incident. The Ecopetrol case shows that reporting to the SEC, Fiscalía, MinTIC, and the press can happen almost at the same time. If the organization has not defined materiality thresholds, reporting owners, and messages by event type, the attacker gains narrative speed. Coordination among security, legal, institutional relations, and the business should be practiced with exercises that include data leaks and leak sites.

Seventh, monitor leak sites and trackers, but do not treat their claims as final truth. Sinop Energia and Oldelval appear on third-party platforms with details about volume and the attributed group, but the July report makes clear that these elements should be treated as indicators, not validation. Watching these sources is useful for early detection, not for closing the analysis.

Material limitations

This report covers only the facts from the July 2026 block provided as research material. Facts from earlier months, although they may appear in the corpus as comparative context, were not counted in the period indicators. The declared time window for the indicators is as follows: 83 facts dated July 2026, 1 undated item excluded from the indicators. The values reproduced in the table match that base exactly.

For executive reading, one important point is that an indicator at 0 does not mean a real absence in the region, only that no record appeared in the material analyzed. This applies in particular to the documented regulatory moves, which appear as 0. The figure does not mean there was no policy or compliance activity in Latin America, only that it did not appear in the corpus used for this report. The same applies to any other category where the material did not show verifiable facts.

It is also worth stressing that the 9 critical CVEs mentioned do not represent the full set of relevant vulnerabilities for the month, only those reflected in the sources available for this report. As a result, a low or zero indicator does not justify concluding that no other vulnerabilities were exploited in the region. This section summarizes only what the material confirmed or documented with sufficient traceability.

On sources, this analysis excluded consumer social networks, sponsored posts, press releases, and commercial content that do not meet the editorial standard required to support trends. For that reason, some facts carry a different degree of certainty depending on the source, especially those coming from trackers, leak sites, or incident aggregators. When the material does not allow a determination of whether there was encryption, exfiltration, or only a mention on a leak site, the report states that explicitly and avoids forcing an artificial classification.