Argentina Cybersecurity Situation, August 2026

Active threats and campaigns in Argentina

Ransomware and extortion, Oldelval as a confirmed case and multiple claims

In August, 34 cases centered on ransomware or extortion, and the material clearly separates three levels of impact. Only three incidents show confirmed asset encryption, another three describe exfiltration without encryption, three more are limited to mention on a leak site, and 25 do not allow the exact classification to be determined.

Oldelval falls into the first group because it confirmed a cyberattack with system recovery, although there was no public confirmation of encryption or exfiltration. The rest of the month was dominated by leak-site campaigns targeting health care, transportation, and technology. That set should not be read as 34 confirmed damage incidents, but as 34 events in which ransomware or extortion was the narrative or operational focus.

Fraud and phishing, lower volume than in July but the same operating vector

Only 2 fraud or phishing cases were documented during the period, compared with 9 in July. The drop does not mean structural relief, because digital fraud remained highly present in the Argentine ecosystem and in the regulatory and legal signals surrounding banking, wallets, and payment methods.

The month’s material again shows the same operating pattern, identity spoofing, WhatsApp messages, fake calls, counterfeit sites, and scams using institutional branding. What is new is not the method, but its continued effectiveness and the burden it is beginning to place on claims, litigation, and stricter authentication mechanisms.

APT and vulnerability exploitation, Argentina as a secondary target in external campaigns

There was no clearly defined local APT campaign during the period based on a primary Argentine source, but there was a relevant technical signal. SCWorld reported that APT groups linked to Russia are exploiting CVE-2026-73570 against government agencies, universities, and state institutions in Brazil and Argentina.

That mention does not make the case a confirmed Argentine incident, but it does place it on the threat radar for the public sector, education, and state infrastructure. The broader context for the month suggests that Argentina remains a target of opportunistic exploitation and regional campaigns, rather than a single isolated sophisticated operation.

Critical vulnerabilities affecting Argentina

The list does not exhaust the country’s vulnerable surface, or the region’s. It includes only the critical vulnerabilities mentioned in this month’s material, and several appear in a regional or global context, not necessarily with confirmed exploitation inside Argentina.

Regulation and compliance in Argentina

Argentina saw a particularly active month on the regulatory front, with concrete steps in cybersecurity, personal data, telecommunications, and financial fraud. The common thread was an effort to bring critical sectors under tighter, more specific rules, although in several cases the framework is still in transition or has not yet become a comprehensive national law.

The most advanced case at the subnational level was Mendoza. The province advanced and then gave half approval to its cybersecurity bill, which creates a Provincial System, a SOC, a CSIRT, and a framework for sanctions, audits, and incident notification. The initiative also adds a Provincial Cybersecurity Strategy and obligations for state technology providers.

At the national level, the BCRA kept expanding its regulatory framework. The Cobro con Transferencia mechanism for loan installments took effect, with explicit conditions for consent, advance notice, and limits on debit attempts. In addition, the Central Bank issued new rules on fraud risk management in payment methods, with phased implementation and full effectiveness scheduled for September 2027.

ENACOM, for its part, extended the rollout of the new RAMATEL until December 1, 2026, and kept a transitional regime for telecommunications equipment approval. That shift is significant. It affects infrastructure, providers, and adaptation timelines, and it adds to the debate over which systems or networks should be considered critical information infrastructure.

The personal data front also remained active. Marval analyzed a new bill that broadens extraterritorial scope, while Congress received proposals on digital violence, cyberbullying, and the protection of children and adolescents. The underlying message is that the country is adding layers of regulation, but still through separate pieces rather than a unified framework.

Most affected sectors in Argentina

The energy sector was the most exposed in August, not because it had the most cases, but because of Oldelval’s systemic importance. The operator of the country’s main oil pipeline turned an administrative incident into a signal of national risk, and that made the episode weigh more than any other individual event in the month. Containment was effective, but the exposure was clear.

Healthcare was the other major focus. Clinics, neurology centers, and private hospitals appeared in ransomware or extortion claims, often with information that had not yet been independently verified. That suggests the sector remains attractive to groups that monetize operational urgency and the sensitivity of clinical data.

Transport and logistics also stayed on the radar. Flecha Bus and other cases, along with Oldelval’s own visibility as an oil logistics network, show that the month had a broader sector map than simple financial fraud. The value of operational assets, the cost of disruption, and the potential for extortion remain decisive factors.

Technology and professional services round out the picture, with Criba, Tecno Accion, and other references appearing on leak sites or intelligence platforms. At the same time, consumer finance and banking kept the background noise going through fraud, complaints, and new collection mechanisms. The public sector, though less visible in confirmed incidents, did appear in regulatory debate and in exposure to leaks and phishing.

Trends and signals to watch in Argentina

Compared with July, the total number of verified incidents fell from 87 to 84, but ransomware accounted for a larger share, rising from 33 to 34 cases. The clearest signal is not a numerical spike, but the same pattern persisting, extortion targeting critical sectors and specific names appearing on leak sites.

The opposite trend appeared in documented fraud or phishing, which dropped sharply from 9 to 2 cases. That should not be read as the problem disappearing. The month was full of context around digital fraud, court rulings, complaints against banks, and new authentication rules, so the decline reflects the makeup of the archive more than a structural easing in the financial front.

The number of critical CVEs mentioned fell from 13 to 10. That also should not be overread. August material continued to show active exploitation of high-profile vulnerabilities, just in fewer verified mentions within the corpus analyzed. The more useful trend is different, the technical attack surface remains broad and ransomware groups are exploiting it quickly.

The variable that merits the closest watch in September is the consolidation of campaigns that publicly pressure health care, transportation, and energy infrastructure. Oldelval showed that the country can contain operational impact, but not that the risk has declined. Add the spread of leak sites with Argentine victims and the continued regulatory agenda, and the next month starts with several open monitoring lines.

Security recommendations for teams in Argentina

1. Review segmentation between administrative networks, industrial systems, and support layers, with a focus on critical infrastructure. Oldelval showed that containment depends on keeping IT from dragging OT down with it.
2. Speed up response capabilities for claims on leak sites. In healthcare, transportation, and technology, the first signal is often public before it is internal.
3. Strengthen authentication and access controls in banking, wallets, and collections processes. Fraud and phishing declined in document volume, but not in their ability to cause harm.
4. Prepare incident notification and traceability procedures, because the local regulatory framework continues to expand and technical security alone is no longer enough.
5. Apply urgent patches to products that show active exploitation, especially those in KEV or those mentioned as an initial vector.
6. Review log retention, restoration, and protection of privileged credentials. In campaigns such as The Gentlemen or Qilin, the pace of operations leaves little room to react.
7. For sectors handling sensitive data, assume extortion may combine real leakage, mention on a leak site, and threat intelligence noise. It is advisable to prepare responses for all three scenarios.

Frequently Asked Questions

What connects Oldelval, health care, and transportation in August?

All three sectors were exposed to ransomware pressure or extortion, but with different effects. Oldelval suffered a confirmed cyberattack with no operational shutdown, health care concentrated several claims on leak sites, and transportation appeared with Flecha Bus. The Relevant Incidents section and the Active Threats and Campaigns section show that overlap.

Did digital fraud in Argentina really fall, or did it just change shape?

The number of documented cases in the month’s material fell from 9 in July to 2 in August, but the problem did not disappear. The context of banking, wallets, complaints, and new BCRA rules shows continuity. The difference is between documented volume and structural persistence, which appears in Trends and Regulation.

What is the difference between a victim on a leak site and a confirmed incident?

A victim on a leak site is a public claim by the attacker or a monitoring portal, while a confirmed incident means validation by the organization, the regulator, or the primary source. In August there were several claimed cases without independent confirmation, such as Sanatorio Modelo de Caseros, Flecha Bus, or AMCA.

What does it mean that 10 critical CVEs were mentioned, and not more?

It means that ten critical vulnerabilities appeared in the month’s analyzed material, not that only ten exist in the region or in the country. The figure does not capture the full technical universe. The Critical Vulnerabilities with Impact in Argentina table explains which ones were actually mentioned in August.

Which sectors should review the full report first?

Energy, health care, transportation, technology, financial services, and the public sector. The month showed a mix of confirmed incidents, extortion claims, and regulatory changes that directly affect those industries. The Incidents, Regulation, and Most Affected Sectors sections cover the details.

Material limitations

This report was built exclusively from the material provided for Argentina in August 2026 and from one comparative fact from July 2026. The indicators reproduce exactly the declared base, 84 verified events from the period, and the time window of 86 events dated in August 2026 plus 1 from prior months used only as a comparative frame.

A zero indicator, or a figure lower than the previous month, does not mean the phenomenon is absent from the region. In particular for CVEs, the count reflects only what was recorded in the material analyzed, not the full set of critical vulnerabilities exploited in Argentina or the Southern Cone.

Aggregated telemetry figures were also excluded, because they are attempts, blocks or automated scans and not incidents with confirmed impact. If they are mentioned, they should be read as technical background noise, not as intrusion volume.

Finally, sources not available in the authorized list were excluded, and publications outside that universe were not used. In the case of social media, only those already integrated into the material as corroborated leads or as secondary evidence allowed by the working file were taken, always without turning them into an independent monthly volume.