Chile: cybersecurity landscape, July 2026

Chile Threat Indicators

Relevant incidents in Chile

Ministry of Transport and Telecommunications, incident still unconfirmed

On July 4, a purported cybersecurity incident was reported that would have affected the infrastructure of the Ministry of Transport and Telecommunications. Coverage cited Vecert Analyzer and VECERT Radar, which classified the case as allegedly, unconfirmed. A database with more than 100,000 records and personal and employment data was also mentioned, but the available material does not allow for a confirmed impact or attribution validated by a Chilean authority.

Smishing campaign impersonating public agencies and companies

On July 29, CronUp described a massive smishing campaign expanding in Chile. The SMS messages led to malicious links that imitated public agencies and companies. The case matters because it connects to two patterns seen during the month, credential theft and the exploitation of trust in urgent or seemingly official communications.

Digital scams during the frontal weather system

On July 21, ADN Radio warned about fraudulent messages tied to fake benefits and alleged service outages during the frontal weather system. The report is relevant because it shows how weather conditions are used as bait for fraud. There was no single dominant technical vector, but rather the reuse of social urgency as a capture mechanism.

Banking vishing and coordinated response from the financial system

Between July 23 and 28, several Chilean media outlets reported bank alerts regarding vishing. The message was consistent, no bank is authorized to ask for PINs, passwords, or codes by phone. The operational signal is clear, attackers continue to use voice, pressure, and impersonation to bypass human controls rather than technical controls.

Threats and Active Campaigns in Chile

Ransomware and extortion with primary impact

In July, 9 cases were documented with ransomware or extortion as the main focus. The material does not always make it possible to tell whether there was encryption, exfiltration without encryption, or only a listing on a leak site. In 1 case, the source describes exfiltration without encryption. In 8, the classification cannot be determined precisely from the material provided.

Leak site mention only, with no verified impact

The ransomware ecosystem showed claims against Chilean victims, including Grupo Minero Las Cenizas and Hardware Asesorías Software Ltda. However, in the cases cited here, the July material does not allow confirmation of an operational impact inside Chile. In one case, the source attributes an alleged leak to a group and labels it an unconfirmed claim. In another, the entry appears in specialized trackers, but the link to Chilean infrastructure or to an actual intrusion is not demonstrated by the evidence provided.

Fraud and phishing

The month recorded 7 documented cases of fraud or phishing. Most were built around impersonation of banks, public agencies and services of public interest. In Chile, social engineering continues to work because it targets fast decisions, not technical perimeter weaknesses. The vishing campaign and the end-of-month smishing are part of the same risk family, even if the channel and pretext change.

APT, opportunistic intrusion and cyber intelligence

The case involving the Ministry of Transport and Telecommunications cannot be labeled as a confirmed intrusion. It does, however, serve as a cyber intelligence signal that merits monitoring. The available material does not provide official TTPs or reusable IoCs, so it should not be placed in an APT category. Even so, it adds pressure on the public sector and shows that threat actors continue to view Chilean state infrastructure as a high-value target.

Critical vulnerabilities affecting Chile

Regulation and compliance in Chile

Regulation dominated the month. The National Cybersecurity Agency issued Exempt Resolution No. 187 and closed the second stage of the first qualification process for Operators of Vital Importance. That placed 239 new entities under a tougher regime for security, continuity, reporting, and oversight. The list is not cosmetic, it reshapes obligations across entire sectors and moves cybersecurity into corporate governance structures.

The Cybersecurity Framework Law was also defined more clearly in operational terms. Essential institutions and OIVs must report significant incidents to the National CSIRT with an early warning within up to 3 hours, an update within 72 hours, and a final report within 15 days. When the event affects essential services of an OIV, the update must be delivered within a maximum of 24 hours. The law also sets graduated penalties and higher caps for vital operators.

The new Personal Data Protection Law 21.719 emerged as a second regulatory front. In July, several reports treated it as already in force or in full rollout. The available material describes obligations to map processing activities, assess gaps, define the legal basis, apply corrective actions, and notify the future Data Protection Agency and the affected individuals within a limited timeframe when the breach involves risk. For banks, fintech companies, and merchants using payment methods, that means more documentation and less room for improvisation.

The deepfake bill adds another layer. The debate is not limited to false content, it also touches digital integrity, consent, traceability, and platform responsibility. Requirements for visible labeling, reporting channels, and removal within 72 hours show a trend toward demanding specific procedural responses, not just broad principles.

Most affected sectors in Chile

The month's sector breakdown put government, finance, health, energy and mining at the center of the accumulated evidence. That does not mean they were the only ones affected, because a single incident can affect more than one sector, but it does show where the signal was concentrated. The mix of government incidents, banking fraud, health alerts and exposure of critical infrastructure points to a country with distributed risks, though not evenly spread.

Government appears twice, as a historical target of incidents and as a focus of the new regulatory framework. The alleged leak at the Ministry of Transport and Telecommunications reinforces that exposure, although there has been no official confirmation. Finance, meanwhile, was affected by three different forces, customer fraud, new enhanced authentication requirements and pressure to comply with personal data rules. It is a sector facing not only attacks, but also a growing obligation to prove that controls are effective.

Health and basic services remain sensitive because of the quality of the data they manage and the social impact of any disruption. The OIV framework extends that sensitivity to water, transportation, fuels, telecommunications and digital infrastructure. That shift matters because it turns sectors long viewed as support functions into central targets for national resilience.

The practical reading is that Chile no longer sees cybersecurity only as perimeter defense for the corporate network. The month showed once again that real exposure comes from the interdependence between data, services, digital identity and operational continuity. When those four elements overlap, the impact is not limited to IT. It reaches the business, the end user and the state.

Trends and signals to watch in Chile

There is no comparable baseline for almost all indicators in the period, so it would be wrong to invent a month-over-month trend where the source does not show one. A strong qualitative trend does stand out, July was more regulatory than the previous months in the available material and more explicit in imposing obligations on critical sectors.

The main signal to watch is the real implementation of the Cybersecurity Framework Law. July showed the shift from the statute to the concrete administration of the regime, with final lists, resolutions and guidance. That should translate into more audits, more reporting and tighter continuity requirements. If OIVs do not mature their capabilities, the regulatory gap will become visible quickly.

Another signal is the hardening of identity fraud. Vishing, smishing and opportunistic scams tied to social or weather-related events show an increasingly professionalized fraud economy. No sophisticated technical vulnerability is needed to cause harm. A poorly managed chain of trust is enough.

It will also be necessary to watch the effect of the new Data Law and the deepfakes bill on platforms, vendors and companies that use generative AI in customer service, marketing or identity verification. The overlap between automation and compliance is no longer theoretical. It is starting to shape contracts, internal processes and reputational exposure.

Finally, the relationship between alerts on actively exploited vulnerabilities and the national inventory of critical assets deserves close attention. OpenSSH, Ivanti, ColdFusion, Citrix and SharePoint are not isolated cases in the report. They are reminders that patching remains a first-order operational obligation, especially where there is internet exposure and essential services.

Security recommendations for teams in Chile

1. Check immediately whether the organization was designated as a Critical Infrastructure Operator and, if so, align governance, response, and continuity with the 3 hours, 72 hours, and 15 days deadlines.
2. Validate notification workflows with CSIRT, legal, continuity, and institutional relations teams. In a regulated incident, the biggest risk is not only technical, it is also coordination.
3. Strengthen anti-fraud controls and out-of-band verification for vishing, smishing, and impersonation of public agencies. Do not trust the channel the attacker controls.
4. Prioritize patching and exposure reduction for internet-facing services. This month’s material includes several examples of active or known exploitation on widely used platforms.
5. If the organization uses generative AI or publishes synthetic content, prepare traceability, labeling, and takedown or correction procedures before the regulation requires them more strictly.
6. Make sure response teams have criteria to classify incidents without overreacting to leak rumors, but also without dismissing early cyber intelligence signals.
7. Maintain an updated inventory of critical assets, especially in transportation, fuels, health, telecom, and digital services, because Chile’s regulatory shift already treats them as surfaces of systemic risk.

Material limitations

This report was built exclusively from the material provided for July 2026 and from the time window stated by the indicators, 70 dated facts in July 2026 and 5 later ones excluded from the count. Facts from other months were used only when comparison was explicitly allowed and always with the month stated.

An indicator at 0, especially the one for critical CVEs mentioned, means none were recorded in the material analyzed during July 2026. It does not mean there were no critical vulnerabilities or active exploitation in the region. In fact, the material does include alerts about OpenSSH, Ivanti, Citrix, ColdFusion, SharePoint and SonicWall, but they were not counted as critical CVEs in the monthly indicator because of the way they were consolidated.

Aggregate telemetry figures, such as automated attempts or blocks, are also excluded from the volume. This month, 8.8 trillion cyberattack attempts in 2025 were mentioned by SEK and ADN Radio, but that figure is volume telemetry, not confirmed incidents with impact. It was not added to the period’s incident count.

The available material excluded sources that are not on the authorized list for citation, including consumer social networks, LinkedIn posts and sponsored or purely commercial content. When any item provided unconfirmed data, the report treated it as such and avoided turning it into settled fact. That is especially important in cases of alleged leaks and ransomware claims, where public evidence does not always rise to the level needed to confirm intrusion, encryption or exfiltration.