Bolivia Cybersecurity Update, September 2026

Active threats and campaigns in Bolivia

Ransomware and extortion

The month did not produce a clear picture of ransomware with verified impact in Bolivia. There were three cases or mentions within the broader ransomware or extortion category, but the available material did not allow a determination of whether the impact involved encryption, exfiltration without encryption, or only an appearance on a leak site. For that reason, the classification remains undetermined.

At the regional level, RedTigerIT identified Latin America as the most targeted area for ransomware and said Bolivia is on operators' radar. That view provides context, but it does not replace confirmed local incidents. In Bolivia's case, the month leaned more toward fraud, brand abuse, and control failures than toward verifiable encryption-based extortion.

Fraud and phishing

The main operational driver was fraud. There were campaigns and cases tied to the use of Banco Unión's name, fake bank pages, bogus ChatGPT subscriptions, and QR code scams. In several of those incidents, the attacker sought to steal credentials, induce transfers, or capture card data.

El Diario's coverage of scams created with artificial intelligence also showed the qualitative shift in deception: cloned voices, urgent messages, suspicious links, and institutional branding used to build trust. ASFI issued recommendations so users can verify official channels and stop the attack before handing over data. The dominant pattern was social, not technical.

APT, bots, and coordinated manipulation

The material did not include solid attribution to a state APT or a named persistent group. What did appear was coordinated manipulation of public conversation, with references to bots, fake accounts, and automated amplification around Bolivian media outlets or pages. It points to disinformation and digital pressure, closer to informal hacktivism or platform manipulation than to a classic advanced intrusion.

The available evidence here is stronger as an environment-level phenomenon than as a traditional security incident. Even so, it matters because it affects reputation, information continuity, and the response capacity of organizations that rely on social networks to communicate.

Critical vulnerabilities with impact in Bolivia

The critical CVE indicator was zero. That does not mean there were no exploited vulnerabilities in the region, or no serious flaws in Bolivia. In fact, the ANH and B-SISA case showed relevant technical and logical weaknesses, but they were not reported under a CVE identifier in the material reviewed.

Regulation and compliance in Bolivia

September was a heavy month for regulation, with 14 documented moves. The most visible package centered on the agreement with the IMF and the role ASFI would play in financial supervision, stress testing, asset evaluation, and prudential strengthening. The prevailing reading is that oversight of the financial system is tightening, not easing.

There were also decrees and registrations with sector-specific impact. Supreme Decree 5693 aimed to strengthen the solvency of financial entities and assign ASFI registration, supervision, and control functions over certain certificates. Renapsi was also created for real estate services, with a focus on transparency, legality, and user protection. In both cases, the logic was to expand traceability and formality.

The crypto agenda followed a different track, still in the stage of commitments rather than final rules. Several reports said Bolivia committed to the IMF to develop a robust framework to regulate and supervise virtual assets, with a focus on money laundering, improper capital outflows, and oversight of operators. The reporting was consistent on one point: there is still no law or active regulation that fully closes that design.

A structural gap also remains. Bolivia still has no general personal data protection law, no specialized administrative authority, and no unified sanctions regime. The Constitutional Court said the privacy protection action exists as an individual judicial remedy, but that does not replace a compliance framework. For sectors that handle financial data, the lack of a framework remains a significant risk.

Most affected sectors in Bolivia

Banking drew the heaviest signal density, both in the volume of attack attempts and in the number of fraud cases and regulatory references. There was no operational collapse, but there was persistent pressure, with phishing campaigns, brand impersonation, the use of AI for deception, and strengthened defenses by several institutions. Traditional banks responded with technology and awareness efforts.

The public sector was also exposed, though in different ways. The ANH showed a structural weakness in a critical fuel system, while SERECI appeared in an alert about an unconfirmed leak. In both cases, the underlying issue was the same, high-value systems with weaknesses in control, traceability, or credential protection.

Industry and business associations saw smaller-scale incidents, but they were useful for reading the attack surface. The case involving the National Chamber of Industries showed account compromise and the need for a digital crisis protocol. The same pattern appears in organizations that are not necessarily part of the financial core, but do manage reputation, information, and communication channels that can be taken over or degraded.

In telecommunications, Tigo provided an availability signal. There was no evidence of a confirmed intrusion, but there were complaints about outages in several parts of the country. At the same time, the material showed that Bolivia remains an environment where digital fraud crosses sectors, from banking and consumer services to identity services and messaging channels.

Trends and signals to watch in Bolivia

Compared with the previous month, September saw more verified incidents, more fraud and more regulation, but less confirmed ransomware. Ransomware or extortion as the primary focus fell from 11 to 3, while fraud and phishing rose from 2 to 10. That shift suggests immediate pressure on users and brands weighed more heavily than encryption as the main attack method.

The regulatory footprint also grew, from 6 to 14 documented moves. That is not a cosmetic figure. It indicates that authorities and institutions tied to the financial system are responding with more rules, more oversight, and more registration requirements. The previous month already showed signs of adjustment, but September consolidated them, especially at ASFI, UIF, FMI, and sector registries.

By sector, the jump from 4 to 8 sectors with documented events suggests broader thematic spread, not necessarily uniformly higher severity. The list included banking, industry, hydrocarbons, telecommunications, media, crypto, data protection, and real estate services. That breadth means risk has to be viewed as an ecosystem issue, not just a problem concentrated in one flagship sector.

The absence of critical CVEs in the month’s material should not be read as technical calm. The B-SISA case shows that a critical operation can fail because of business logic, weak authentication, unsafe manual controls, or exposed credentials, without any published CVE being involved.

Recommendations for security teams in Bolivia

First, banks and fintech firms need to tighten identity validation and session-abandonment flows, because most of September’s damage came from phishing, impersonation, and brand abuse. MFA, biometrics, anti-fraud limits, anomaly monitoring, and out-of-band verification should be tied to customer education campaigns that do not rely only on static materials.

Second, organizations that manage social media accounts or public channels need stricter access recovery plans and credential rotation. The case of the Cámara Nacional de Industrias shows that a compromised institutional account can become a vector for disinformation or reputational loss within hours.

Third, the public sector and critical infrastructure operators need to review their control logic, not just their perimeter. The ANH and B-SISA incident highlighted backdoors, exposed passwords, weak validation, and unsafe manual controls. That requires business auditing, segregation of duties, and privilege review.

Fourth, legal and compliance teams should prepare for the new regulatory cycle. With ASFI, UIF, FMI, Renapsi, and the future virtual assets framework advancing at different speeds, institutions will face more demands for traceability, reporting, and documentation. The absence of a data law does not reduce the pressure, it shifts it toward litigation, reputation, and self-regulation.

Fifth, any entity that processes payments, customer data, or identities must assume that AI-enabled fraud is already part of the local threat landscape. Telling users to "check the sender" is not enough. Organizations need stronger communication filters, domain protection, and warnings about fake pages, voice clones, and messages with artificial urgency.

Frequently Asked Questions

What changed more between September and the previous month in Bolivia, fraud or ransomware?

Fraud and phishing rose more than ransomware in September. Fraud or phishing cases increased from 2 to 10, while ransomware or extortion cases fell from 11 to 3. The comparison appears in the indicator table and in the Active Threats and Campaigns in Bolivia section.

Which incident created the highest operational risk for Bolivia's critical infrastructure?

The intervention at ANH and the discovery of nine vulnerabilities in B-SISA was the most serious case for critical infrastructure. It affected fuel control, system integrity, and operational traceability. The technical breakdown is in Relevant Incidents in Bolivia and Critical Vulnerabilities with Impact in Bolivia.

Was there evidence of a confirmed mass data breach in September?

The material shows signals and claims, but no solid operational confirmation of a mass breach verified by a primary source. It includes mentions of SERECI and rumors on cybercrime channels, along with the absence of a data law that makes oversight difficult. See Material Limitations and Regulation and Compliance in Bolivia.

What role did ASFI play in the month, and why does it matter for cybersecurity?

ASFI appeared as a reinforced supervisor of the financial system under the IMF agreement and new measures for financial entities. This matters because banks face more digital fraud, more control requirements, and greater compliance pressure. The details are in Regulation and Compliance in Bolivia and Most Affected Sectors in Bolivia.

Were any critical CVEs exploited in Bolivia during September?

No. The critical CVE indicator was zero in the material analyzed. That does not mean vulnerabilities do not exist in the region, only that no critical CVEs appeared in this corpus. The ANH case shows that severe impact can occur without a CVE published in the report.

Material limitations

The report was built exclusively from the material provided for September 2026 and the specified 84 dated events in that month. The indicators reproduce the declared base in the input and do not add aggregated telemetry as if it were incident data, because those 5 records correspond to automated attempts or blocks, not confirmed impacts.

A zero value, especially for critical CVEs, means there were no verifiable mentions in the material analyzed for this month. It does not mean there are no critical vulnerabilities in Bolivia or in the region. Likewise, several ransomware events were left as undetermined classification because the material did not specify whether there was encryption, exfiltration, or only a mention on a leak site.

Items without a confirmed date were also excluded from the count. The sources excluded from the core analysis were consumer social networks, sponsored posts, promotional content, and material not included in the list of approved sources. When a claim came from a source with uncertain attribution, it was treated as contextual signal and not as a fully corroborated fact.