Chile Cybersecurity Situation, September 2026

Threats and active campaigns in Chile

Ransomware and extortion in Chile

September recorded 17 cases with ransomware or extortion as the main focus, with most cases falling into a category where the source does not clearly show whether there was encryption, exfiltration, or only a claim on a leak site. In practice, the picture was dominated by the public visibility of leak sites and by a few incidents with real operational impact.

Among confirmed encryption cases, Fosko stands out. Cases limited to mention on a leak site include Forus, Tanner, Vigatec, S.A. Chile, and other incidents linked by third parties or tracking repositories. Several other events remain uncategorizable because the material does not clarify whether there was encryption, exfiltration, or both.

The case of Hospital Clínico de la Universidad de Chile deserves separate mention even though it does not fit the taxonomy perfectly, because the source describes a cyberattack with medical data leakage and, in the tracking ecosystem, it was linked to ransomware. From a risk perspective, the key point is that health care remained a high-value target for extortion actors.

Fraud and phishing in Chile

The 6 documented fraud or phishing cases confirm that September was a more active month than August in this area. The Central Bank warned about a deepfake video impersonating its president, ANCI warned about abuse of OAuth Device Code Flow, T13 described the SIM swapping method, and the National CSIRT detected active brand impersonation campaigns.

Also noteworthy is the continued banking scam that uses the RUT to block accounts and then asks for verification codes, along with the public debate over bots and disinformation. The combination matters because it brings together classic social engineering, identity abuse, and automation, without relying on sophisticated malware.

APT and hacktivism in Chile

The material did not include any clear case that would allow APT to be classified with confidence for September. There were digital manipulation campaigns, bots, disinformation, and coordinated operations on social networks, but the period’s corpus points more to fraud, extortion, and data theft than to a classic APT campaign against Chilean targets.

The regulatory and political context around bot farms, deepfakes, and public opinion manipulation is strong. But based on the evidence available, it should be treated as a front of disinformation and abusive automation, not as a consolidated APT attribution.

Critical vulnerabilities affecting Chile

No critical CVEs were reported in the Chilean material for the period, but there were relevant alerts in the region and in products used by local organizations, especially GitLab, Cisco, Ivanti, Fortinet, and MikroTik.

Regulation and compliance in Chile

Chile closed September with a dense regulatory agenda covering data protection, cybersecurity, payment systems, and digital environments. The most important item was Decree No. 662, published on September 9, which approves the regulation on infringement prevention models in personal data protection under Law 21.719.

The regulation sets requirements, modalities, and procedures for implementing, certifying, registering, and supervising those models. At the same time, the government submitted to the Senate the bill that would delay the entry into force of Law 21.719 by one year, while public debate continued to stress that the postponement had not been approved by month-end.

On the sector side, the Cybersecurity Framework Law 21.663 kept rolling out obligations for operators of vital importance and essential service providers. The month’s material highlighted 3-hour deadlines for early warning, 72 hours for the first assessment, and 15 days for the final report, in addition to the obligation to report incidents to the National CSIRT.

Payments regulation also kept moving. The CMF tightened authentication requirements, and debate over the MK4 reform reshaped liability for fraud. At the same time, the reserve of vehicle data used in covert police operations and the bills on digital manipulation, bots, and deepfakes show a broader regulatory perimeter around data and content.

Regulatory milestones for the month

Compliance implications

The month’s regulatory signal pushes organizations to review data inventories, legal bases, access controls, traceability, retention, and incident response. The material shows that compliance within a single framework is no longer enough, because one event can trigger obligations across personal data, cybersecurity, and financial fraud.

In banking and payment services, the convergence of stronger authentication, user liability presumptions in certain cases, and AI-assisted fraud channels requires legal, fraud, technology, and security teams to align. In health care and the public sector, the pressure comes from operational continuity, protection of sensitive data, and the ability to notify promptly.

Most affected sectors in Chile

Health, finance, the public sector, and retail concentrated the month’s most sensitive signal, although the distribution was not exclusive and several incidents cut across more than one sector at a time. Health stood out because of the Hospital Clínico de la Universidad de Chile case and the debate over ransomware with catastrophic reach. Finance came under pressure from fraud, authentication, and phishing campaigns.

In the public sector, Operación Rutify showed a massive extraction of information from multiple agencies. In retail, Forus added a contained incident that affected sales channels. In manufacturing, Fosko showed that ransomware is still hitting production continuity, not just administrative systems.

There was also a signal in telecommunications and digital platforms because of the debate over interception, jammers, bots, and deepfakes. That overlap matters because it expands the exposure set beyond the sectors usually seen as most sensitive and shifts attention toward reputation, identity, and content.

The sector-by-sector risk picture is that health and finance remain the areas under the heaviest combined pressure from confidentiality, continuity, and regulation. But the month made clear that digital government, retail, and manufacturing are also within reach of opportunistic campaigns or actors seeking extortion.

Trends and signals to monitor in Chile

Compared with August, September recorded fewer verified incidents overall, fewer unclassified incidents, and fewer cases where ransomware or extortion was the primary focus. Even so, documented fraud and phishing cases rose from 2 to 6, and the month shifted more toward identity abuse, impersonation, and active deception campaigns.

The regulatory trend also changed shape. In August, pressure around data and cybersecurity was already building, but in September it hardened into regulations, bills under review, technical alerts, and new debates over liability. Law 21.719, the Framework Cybersecurity Law, and the strengthened authentication rules continued to set the agenda.

In ransomware, the monthly picture shows a decline from August, although the problem did not go away. It kept appearing in multiple forms, from cases with confirmed encryption to simple mentions on leak sites. For operational monitoring, that means not overreacting to every claim, but also not underestimating the broader pattern.

The most important signal to watch in October is the convergence of fraud, identity, and automation. The Central Bank case, alerts from the National CSIRT, SIM swapping, and OAuth abuse show that an attacker does not necessarily need to exploit a CVE to compromise an account, drain a channel, or erode trust.

Recommendations for security teams in Chile

Review incident response processes so a single event can trigger technical, legal, and regulatory notifications without duplication or gaps. The combination of the Cybersecurity Framework Law, the future data authority, and sector-specific obligations calls for coordinated playbooks and clear timelines.

Prioritize identity controls. This month's material shows abuse of OAuth, SIM swapping, brand impersonation, and financial deepfakes. Phishing-resistant MFA, validation of sensitive changes through separate channels, and monitoring for authentication anomalies should be at the top of the list.

Harden the exposed attack surface on collaboration and development platforms, especially GitLab, and keep patching cycles short for software with active exploitation or recently fixed critical flaws. Although there were no critical Chilean CVEs this month, there was relevant indirect exposure through vendors and tools used locally.

Operationally separate plans for encryption, extortion without encryption, and leak sites. September's material made clear that not every case attributed to ransomware amounts to a confirmed intrusion with operational impact. That distinction improves prioritization and avoids rushed decisions.

Strengthen inventory, classification, and retention of personal data, especially in health care, finance, retail, and the public sector. Operation Rutify and the case of the Hospital Clínico de la Universidad de Chile show that the value of data remains the center of gravity of risk.

Frequently Asked Questions

What is the difference between the September ransomware cases and active fraud?

In September there were 17 cases with ransomware or extortion as the primary focus and 6 documented fraud or phishing cases. The first group ranged from confirmed encryption, as in Fosko, to simple mentions on leak sites, while the second centered on impersonation, SIM swapping, deepfakes, and authentication abuse.

Which sectors should prioritize immediate action after this month?

Health care, finance, the public sector, and retail were the most pressured by events during the period, although several incidents affected more than one sector. Health care because of medical data exposure, finance because of fraud and authentication, the public sector because of Rutify, and retail because of the Forus case are the clearest priorities.

How does the regulatory agenda intersect with operational incidents?

The overlap is direct: Law 21.719 pushes controls over personal data, the Cybersecurity Framework Law requires reporting and incident handling, and the CMF deepens authentication and fraud responsibilities. A single event can trigger different obligations depending on the type of data, system, and sector involved.

Why does the report insist on distinguishing leak sites, exfiltration, and encryption?

Because they do not carry the same operational impact or the same legal weight. A mention on a leak site may be only a claim, exfiltration without encryption points to simple extortion, and confirmed encryption implies service disruption or degradation. Mixing them distorts the risk picture.

What should a team in Chile review this week?

It should review phishing-resistant MFA, cross-notification procedures, exposure of critical software such as GitLab, and response plans for fraud involving compromised identities. It is also worth validating inventories of personal data, because September showed that regulatory pressure and technical pressure are already overlapping.

Material limitations

This report was built exclusively from the material provided for Chile in September 2026. The indicator window is the one stated at the start, 62 dated facts in September 2026, plus 1 undated fact that was excluded from the indicators. No internet or external information was used.

An indicator at 0, especially in the critical CVEs mentioned, means it did not appear in the material analyzed for the period. It does not mean there were no critical vulnerabilities or active exploitation in the region. In fact, the corpus does include relevant alerts outside Chile that provide context, but they do not change the national indicator value.

Undated facts may be used only as qualitative context. In this case, the undated material was not counted in the indicators. Aggregated telemetry, or automated attempts and blocks treated as incidents, were also excluded.

Consumption sources and content excluded under editorial criteria when they were not on the allowed list were left out of the count, along with LinkedIn posts and other social networks not enabled as evidence. Where a source showed uncertain attribution, the report treated it as such and did not elevate it to confirmation.

Frequently Asked Questions

What changed between August and September in ransomware, fraud, and regulation in Chile?

September saw fewer total incidents than August. The volume of ransomware or extortion dropped, and unclassified incidents also declined, but fraud or phishing cases increased. At the same time, regulation gained weight with the implementing rules for Decree 662, the bill to extend Law 21.719, and new proposals on bots and deepfakes.

What is the relationship between the Rutify case and the Hospital Clínico de la Universidad de Chile?

Both show the value of data as a central target, but they stem from different vectors. Rutify was a mass data extraction and resale operation involving multiple agencies, while the hospital confirmed a cyberattack with a leak of confidential medical information. Together, they explain why health care and the public sector were so exposed.

What should banks and fintechs prioritize in light of what happened this month?

They should strengthen phishing-resistant authentication, review credential-change processes, monitor SIM swapping, and align legal and technical response to fraud. The month combined deepfakes, impersonation campaigns, OAuth abuse, and regulatory changes from the CMF, so identity and traceability move to the forefront.

Why does the report not treat every mention on leak sites as a confirmed incident?

Because many are only claims from ransomware groups or third-party trackers. Without confirmation from the victim, without technical data, and without evidence of operational impact, the material should be treated as a leak site mention. That distinction avoids artificially inflating the month’s severity.

What regulatory signal should be watched closely in October?

The effective entry into force of Law 21.719 and the progress of the extension bill, together with implementation of the rules under Decree 662. In parallel, developments on fraud in payment media, police data confidentiality, and projects linked to bots and AI-generated content should also be tracked.

Does zero critical CVEs mean there were no serious vulnerabilities in the region?

No. It means that no critical CVEs appeared in the material analyzed for Chile in September. The corpus does include critical advisories and active exploitation in other countries and products, but they were not recorded as a Chilean signal for the period within the sample used for this report.

Material limitations

This report is limited to the material provided for Chile and to the September 2026 period. The indicators are calculated only from the 62 events dated within that period, while 1 event with no confirmed date was excluded from all metrics. No aggregated telemetry was available to convert attempts or blocks into incidents.

A value of 0 in an indicator, especially in mentioned critical CVEs, means it did not appear in the material analyzed for the month. It does not mean there were no vulnerabilities or active exploitation in the region. The corpus does include comparative references outside Chile, but they are not included in the national count.

Sources excluded by editorial rule were not used as evidence, and mentions in unapproved social media channels were also left out of the analytical body. When a source showed uncertain attribution or opaque methodology, it was treated as such and was not elevated to direct confirmation.

The final result therefore reflects only what was actually verified in the document set provided, not the full universe of incidents that may have occurred in Chile or the region during September.