Argentina Cybersecurity Situation, October 2026

Relevant Incidents in Argentina

Attack on Program Consultores and municipal service outages

The attack on Program Consultores S.A. was the largest incident of the month in Argentina. It encrypted files, took servers offline, and disrupted municipal procedures, billing, and portals across several provinces. The operational impact was national, although the initial vector and the size of any exfiltration, if there was one, were not conclusively established.

The sequence began in the provider's infrastructure and spread to client municipalities. Coverage from different media confirmed interruptions in Punilla, Santa Cruz, Río Negro, Santa Fe, and other jurisdictions, with an impact that exceeded 250 municipalities and communes. The company said there was no theft of databases or leak of confidential information, but that point remained subject to each local authority's interpretation.

The case combines confirmed operational impact with a clear ransomware classification. It also points to a structural issue, when a centralized provider goes down, the interruption surface multiplies.

Cyberattack on the Government of Formosa

The Government of Formosa reported a cyberattack that affected its digital systems and led to a preventive suspension of services. The statement did not specify the type of attack, the actor, or whether data was stolen, so the incident remains confirmed but not classified.

The same jurisdiction also reported a second notable episode, this time in the Judiciary, which temporarily interrupted services such as the official website, e-Justice, and webmail because of critical security vulnerabilities. Taken together, Formosa showed a pattern of preventive containment in response to cybersecurity problems that affected public service delivery.

Sexual deepfakes at a school in Lomas de Zamora

The spread of fake sexual images created with AI at a school in Lomas de Zamora was one of the month's most sensitive incidents because of its impact on minors. The court reviewed the defendants' phones, the case was assigned to juvenile court, and different reports indicated that dozens of students were affected.

The significance of the case lies not only in the technology used, but also in how it was distributed. The material was tied to sales, circulation in messaging groups, and exposure at school, turning the episode into a form of digital violence with criminal, educational, and personal data protection consequences.

Threats and active campaigns in Argentina

Ransomware and extortion

The month produced 10 cases where ransomware or extortion was the primary focus. In two of them, asset encryption was confirmed. One involved exfiltration without encryption, and in seven cases the available documentation does not allow a determination of whether there was encryption, exfiltration, or only public claiming of the victim.

The clearest example is Program Consultores, where the company acknowledged that a virus encrypted files and rendered servers inoperable. The Villa Carlos Paz case was tied to that same infrastructure, and the municipality clarified that the attack did not directly hit its local network. In other claims, such as those listed by criminal groups or intelligence sources, the public evidence is not enough to distinguish a mention on a leak site from a proven intrusion.

Fraud, phishing, and digital scams

The 8 documented fraud or phishing incidents show a continued victim-focused attack pattern, not an infrastructure-focused one. There were rulings and judgments against banks for failures in their duty of security, a phone scam that led to unauthorized loans, and an investigation into a fraudulent investment scheme that used Gmail ads, fake media outlets, and public figures.

Digital scam-as-a-service also surfaced, with Argentina among the countries tracked by Group-IB in Classiscam, a scheme that uses Telegram bots to deploy fraudulent pages. Added to that is the consolidation of identity theft and WhatsApp-based fraud, which the Córdoba prosecutor's office described as an environment dominated by social engineering and account takeovers.

APT, influence, and offensive use of AI

OpenAI reported the suspension of accounts originating in Russia that were used for covert influence operations focused on Argentina and Bolivia. This line of activity does not amount to classic espionage, but it does confirm offensive uses of AI to produce content, fake profiles, and insertion into political debates.

In the same month, the material indicated that actors used AI agents to compromise Argentine healthcare organizations, and that one of the reported campaigns covered at least 15 entities. Although the institutions and data volumes were not fully identified, the point is significant because it shows a more industrialized use of AI for reconnaissance, target selection, and task execution.

Critical vulnerabilities affecting Argentina

The most relevant signal is not just the existence of the two CVEs, but the operational response they triggered. BA-CSIRT issued an alert rated 9.2 out of 10, and Argentina's CERT surveyed state sites to estimate technology exposure. The material does not show exploitation in Argentina, but it does point to a broad set of assets potentially affected by vulnerable software.

Regulation and Compliance in Argentina

The month’s most significant regulatory development was CNV General Resolution 1172/2026 for Virtual Asset Service Providers. The rule requires risk-based cybersecurity policies, procedures, and controls, and it obligates providers to report material outages, cyberattacks, fraud, and security incidents that compromise customer funds or data.

The scope is substantial. CNV brought governance, identification, protection, detection, response, and recovery into the regime applicable to PSAVs. It also made clear that periodic reporting will take effect on November 1, 2026, even though the resolution entered into force the day after its publication.

At the same time, the month was shaped by compliance and liability cases in traditional banking. Rulings in La Plata, Santa Rosa, and other jurisdictions reinforced the view that financial institutions cannot disassociate themselves when there are unusual transactions, access from unusual locations, or clear signs of fraud. That again puts early detection, identity verification, and transaction traceability in focus.

Most Affected Sectors in Argentina

The public sector took the hardest hit, both in volume and in domino effect. Municipal governments, provincial administrations, and judicial agencies dealt with system outages, service suspensions, and authentication or operational continuity problems. Reliance on outside vendors, as in the case of Program Consultores, widened the impact beyond a single institution.

The second major focus was finance, though the pattern was different. Fraud against users, phishing, identity theft, and legal disputes over banks’ duty of care dominated the picture. The risk came less from a large-scale attack on banking infrastructure than from tactics that exploit weak links in the customer relationship.

Education and health care also featured. In education, sexual deepfakes in schools triggered a legal and media response with major impact. In health care, the material shows AI agent campaigns reported by CrowdStrike against Argentine organizations, although the public detail is too limited to map the exact impact case by case.

Trends and signals to watch in Argentina

The comparison with the previous month shows a clear shift. In September, ransomware was the dominant focus, with 33 of 66 incidents. In October, incidents took that lead, with 17 of 57 cases, while ransomware fell to 10 and fraud or phishing jumped from 0 to 8. The shift points to a broader spread of attack vectors and less concentration in a single family of threats.

Regulatory moves also lost ground, slipping from 7 to 5, and critical CVEs mentioned dropped from 8 to 2. That does not mean technical exposure eased. It means the month’s coverage focused less on vulnerabilities and more on operational fallout, fraud, and court cases.

The continuity that still deserves attention is social engineering. Cases of banking phishing, phone fraud, and AI-driven investment scams point to the same attack surface, user or employee manipulation to gain access, authorization, or a transfer. When that is paired with centralized vendors or poorly segmented environments, damage escalates quickly.

Security recommendations for teams in Argentina

Critical software vendors should be treated as part of the organization’s own perimeter. The PGM case showed that an incident at a third party can leave hundreds of municipalities without a system. Contracts, continuity testing, notification timelines, and contingency plans should be reviewed as if the vendor were a direct extension of the local environment.

On identity and fraud, the priority is to strengthen out-of-band validation for sensitive transactions. Phishing and phone fraud cases show that a user, a token, and a phone call can still be enough to carry out transfers or take out loans if the institution does not cross-check risk signals, geolocation, behavior, and device changes.

For entities that manage sensitive data or data relating to minors, the recommendation is to raise the review threshold before publishing or sharing content, and to formalize response channels with legal, compliance, and victim support teams. October made it clear that the reputational, legal, and human damage from a leak or a deepfake can be as severe as the technical damage.

On the technical side, organizations with exposed PHP should urgently review the two CVEs of the month, verify versions, disable risky functions where applicable, and confirm that mitigation does not depend only on temporary runtime changes. Where shared infrastructure exists, asset inventory and coordinated patching matter as much as detection.

Frequently Asked Questions

What changed between Argentina's September and October risk profiles?

October shifted from a month dominated by ransomware to one dominated by operational incidents and fraud. According to the indicators, ransomware or extortion fell from 33 cases to 10, while unclassified incidents rose from 10 to 17 and fraud or phishing increased from 0 to 8. That reshaped response priorities.

What sectors connect the attack on PGM with the month's banking cases?

The attack on PGM hit the public sector, especially municipalities and local administration, while the banking cases were concentrated in fraud, phishing, and duty-of-care issues toward customers. The link is in the dependency model, not the technique: both show failures in continuity, authentication, and transaction validation.

Why do sexual deepfakes appear as a cybersecurity issue and not only a criminal one?

Because they combine digital creation, platform distribution, exposure of minors, and possible improper handling of personal data. The Lomas de Zamora case crossed juvenile justice, schools, messaging, and AI-manipulated content. The month's material shows the risk is not only technological, but also institutional and legal.

What is the connection between the PHP vulnerabilities and the review of government sites?

The two critical PHP CVEs triggered a direct alert from BA-CSIRT and led Argentina's CERT to review gob.ar sites. The review does not prove exploitation in Argentina, but it does show there was a broad base of sites with PHP indicators, which makes patch management an operational priority.

What does CNV's new rule require PSAVs to report?

General Resolution 1172/2026 requires reporting material system outages, cyberattacks, fraud, and incidents that compromise customer funds or data. It also imposes cybersecurity policies and controls based on risk. For Argentina's local crypto sector, that raises the standard for governance and response.

Do the 17 unclassified incidents mean there were more attacks that could not be confirmed?

Not necessarily. It means the analyzed material included 17 events with operational or security impact, but without enough technical detail to classify them precisely. They may be breaches, outages, or attacks at different stages of confirmation. The Limitations section explains that nuance.

Technical appendix: indicators of compromise and TTPs

TTPs published for the attack on Program Consultores

The Program Consultores case showed a ransomware pattern involving file encryption and outages at servers hosted on shared infrastructure. The source also mentioned ransom demands and disruptions to management, billing, and administrative systems. No hashes or domains were published, but the tactic of operational disruption through encryption was.

TTPs and tools observed in fraud and APT campaigns

The material on Classiscam, CallFlow, and OpenAI influence operations points to a combined use of bots, synthetic voice, language models, and automation for fraud and influence. In the fraudulent investment campaign, the dominant tactic was impersonation of media outlets, public figures, and real brokers to push deposits.

Public IoCs and technical signals linked to PHP2Shell

Black Kite, Censys, AWS, CERT/CC and Unit 42 published technical signals on PHP vulnerabilities. IPs observed in exploitation attempts included 103.216.220.92, 31.223.184.166, 37.19.200.5, 134.209.159.64 and 103.114.163.188. The material does not link them to a specific actor or to any specific Argentine case.

Material limitations

This report was built exclusively from the material provided for October 2026, and it counts only the events dated within that window as part of the month’s volume. Events from earlier months were used only to compare trends when relevant, never to add to the period’s activity.

A zero figure does not mean the phenomenon was absent in the region, only that it did not appear in the material analyzed for the month. This applies especially to CVEs, where the count reflects what was recorded in the period’s sources, not the nonexistence of critical vulnerabilities in Argentina or in the region.

The available coverage combined media reports, official sources, technical advisories and some background reporting. Social media posts were not used as evidence, nor was aggregated telemetry treated as if it were an incident. Events without a confirmed date and claims that could not be corroborated with primary sources or sufficient confirmation were also excluded from the count.