Chile Cybersecurity Situation: October 2026

Active threats and campaigns in Chile

October brought a mix of ransomware, fraud, and extortion signals that should not be read as a single category. The month included two cases with confirmed encryption, one case mentioned only on a leak site, and one where the source did not allow a determination of whether encryption occurred, along with a solid block of phishing and AI-assisted vishing.

Ransomware with confirmed encryption: Huatacondo and the LD Constructora case

The month’s material confirms two situations involving encrypted assets or extended unavailability tied to a cyberattack. Huatacondo is the clearest case because of its sustained operational impact on electrical infrastructure, while the LD Constructora environment appears in coverage tied to a claim attributed to Qilin, although there is not enough public evidence to close the technical chain.

In the LD Constructora case, AllDefense Chile noted that there was no public confirmation from ANCI, the Government CSIRT, or the company itself to corroborate the claim. For that reason, the file should be read as a ransomware claim with incomplete verification, not as a fully proven intrusion.

Ransomware on a leak site: Aerotop and ANWO

Aerotop was listed on Qilin’s leak site on October 23. Placement on a leak site does not by itself prove initial access, encryption, or exfiltration, but it does indicate that the claim exists and warrants monitoring.

ANWO was also added to a claim attributed to SafePay. In both cases, the available material does not confirm operational impact or the volume or nature of the compromised data. The difference between a claim and a verified breach is central here, because the month included several examples of declared extortion with uneven support.

Ransomware with undetermined classification: the case reported by Entel Digital

A report by Entel Digital cited by the local press mentioned 55 ransomware victims in Chile between January 2025 and September 2026, 18 of them in critical infrastructure. The material does not allow a breakdown of which part corresponds to encryption, exfiltration, or a claim without verified impact within October’s monthly cutoff.

The value of that data lies in the sector map, not in attributing a specific October case. It shows a persistent concentration in transportation and logistics, energy, fuels, water and sanitation, as well as health and government, but it does not replace the reading of individual incidents.

Fraud, phishing, and AI-assisted vishing

The fraud block was one of the most consistent themes of the month. The PDI warned that artificial intelligence makes phishing messages more credible and allows identities to be impersonated during video calls using manipulated images, audio, or video in real time. That line appeared repeatedly across coverage and points to a form of deception that is more personalized and harder for end users to detect.

Mundo en Línea, ITsitio Chile, and ADN Radio added the detail that, according to Infobip, 71% of the phishing fraud detected in Chile corresponded to AI-powered vishing. The figure does not describe a single incident in the country, but a channel and technique trend that helps explain why phishing kept appearing among the month’s events.

SIM swapping, voice cloning, and fake pages

Conadecus explained how phishing can be a first step toward SIM swapping, a chain that ends with control of the phone number and interception of verification codes. T13 and BioBioChile also reinforced that warning by describing the method that leaves the victim’s phone without service.

The month’s material also added warnings about fake pages that imitate stores, fabricated support channels, and the use of cloned voices to pose as banks, bosses, or relatives. Together, these are not just variants of the same fraud, but a toolkit that combines social engineering, automation, and reused exposed data.

Critical vulnerabilities affecting Chile

Chile published and continued to track a relevant PHP alert throughout October. Although it is not tied to a specific local victim, it affects the national ecosystem because of exposure in web services and business components. The most sensitive issue is not just the CVEs themselves, but their active exploitation and the need for immediate patching.

ANCI's alert recommended applying available updates immediately. CISA and the Canadian Centre for Cyber Security confirmed known exploitation, and Unit 42 described unauthenticated remote code execution in a chain that can end in shells and persistence. For Chile, the implication is direct for any Internet-exposed asset that relies on PHP, especially when it cannot be patched quickly.

Regulation and compliance in Chile

October's regulatory agenda was intense and showed a state still pushing more concrete controls over data, public procurement, and authentication. The month did not close with a single reform, but with several parallel measures that are already forcing teams to treat compliance and cybersecurity as one front.

The Senate advanced the bill that postpones the entry into force of Law 21.719 on Personal Data Protection until October 15, 2027, although a final effective date had not yet been set by month-end. The stated goal was to give companies, public agencies, and the future Personal Data Protection Agency more time to adapt.

The proposal also calls for expanding the Agency’s Board of Directors from three members to five. That matters not only for governance, but because implementing a data law depends on institutional capacity, technical rules, and real oversight, three pieces that do not always move at the same pace.

ChileCompra, meanwhile, approved Public Procurement Directive No. 47/2026, developed with the ANCI, to bring cybersecurity into public purchases involving systems, personal data, or sensitive institutional information. The document includes 17 model reference clauses on confidentiality, incident notification, access, audits, and information restoration.

On the financial front, the CMF continued acting on information handling deficiencies and the sale of unregistered products. Debate also continued over stronger authentication and identity mechanisms, with an ANCI public consultation on MFA and references to the CMF’s Atena sandbox for testing integrations with the Open Finance System.

Most affected sectors in Chile

Sector distribution this month confirms that Chile continues to face its most serious risk where continuous operations, sensitive data, and third-party dependence overlap. Energy, finance, health care, and public administration appear repeatedly, though each shows different types of impact and different levels of technical evidence.

In energy, the Huatacondo case remains the clearest because of its duration and the explicit reference to a cyberattack in the log of the Coordinador Eléctrico Nacional. That episode gives the sector a visibility that does not depend on volume, but on operational criticality. It does not take many cases for one alone to shape the month’s reading.

In finance, the damage was more dispersed. There were CMF complaints, debate over document fraud, and warnings about AI-assisted impersonation. The financial block did not stand out for major confirmed technical compromises, but for the ability of attackers or scammers to exploit digital processes, weak validation, and fake service channels.

Health care was strained by the leak at Hospital Clínico de la Universidad de Chile and by the noise generated by unconfirmed claims. In this sector, the problem is not only the theft of information, but also the reputational and operational impact of any doubt about continuity, credential protection, and access to clinical systems.

In public administration and state procurement, the signal pointed to regulatory maturation. The ChileCompra directive, the debate over the data law, and ANCI’s consultation on multifactor authentication sketch a state trying to standardize requirements before incidents or breaches force it to do so reactively.

Trends and signals to monitor in Chile

The clearest shift from the previous month was the drop in ransomware as the main focus, from 17 incidents out of 62 to 4 out of 44. Documented fraud or phishing cases also fell, from 6 to 3, and regulatory moves declined from 11 to 9. The trend, however, is not one of simple relief, but of a reshaping of risk.

The dominant threat shifted from ransomware to unclassified incidents. That suggests October brought more operational noise and fewer extortion cases with clear public attribution. For a security team, the relevant point is that the risk surface did not shrink, only the type of evidence that reached the press and public records changed.

The other signal to watch is active PHP exploitation. Although the material does not link the CVEs to any specific Chilean victim, the existence of local alerts and the international confirmation of known exploitation raise the practical value of that finding.

The digital identity front also warrants monitoring. October showed that banking fraud, SIM swapping, AI-assisted phishing, and fake pages are no longer separate silos, but linked stages in the same chain. The previous month had already shown pressure on credentials, and October added more convincing tools to obtain and reuse them.

On the regulatory side, the key question is whether legislative progress turns into real implementation. The Senate moved the data law forward, but standards, capabilities, and enforcement still remain. ChileCompra and ANCI, for their part, made clear that technical requirements are shifting toward clauses, processes, and stronger authentication.

Recommendations for security teams in Chile

Security teams in Chile should focus on three immediate areas. The first is patching and web exposure, especially in PHP environments and services exposed to the internet. The second is identity and fraud, with tighter controls on MFA, out-of-band verification, and anti-fraud procedures for service channels and payments. The third is operational continuity in critical assets, especially where a technical failure could spill over into telecom, energy, or administrative processes.

In practical terms, teams should review which systems use PHP and whether any exposed versions have not been updated recently. For organizations with critical web components, patching is not enough. They also need to shrink the attack surface, isolate exposed services, and monitor for post-exploitation signals such as shells, abnormal downloads, or execution in writable directories.

For fraud and phishing, the recommendation is to treat AI as a force multiplier for deception, not as passing noise. Identity validation flows need to be strengthened, customer service and back-office teams need training, and response playbooks should be designed for calls or video calls that seem urgent but do not go through verified official channels.

In the public sector and among state vendors, ChileCompra Directive 47/2026 should be treated as a baseline, not as a paperwork exercise. Notification, confidentiality, audit, and information restitution clauses only work if they are tied to internal owners, regular testing, and risk criteria applied to the actual contract.

Finally, in critical infrastructure, October leaves a simple operational signal, do not assume that a single isolated environment will absorb the impact of an outage. Power continuity, communications resilience, and incident traceability have to be tested together, because the month showed that failures rarely stay inside one system.

Frequently Asked Questions

What changed between September and October in Chile regarding the dominant threat?

In September, ransomware was the main threat. In October, the leading threat shifted to unclassified incidents. The dataset also changed from 62 to 44 verified events, with fewer ransomware cases, less phishing, and fewer regulatory moves, but continued pressure on energy, data, and digital fraud.

Which ransomware cases were better supported, and which were not?

Huatacondo was supported as a prolonged outage linked to a cyberattack, while LD Constructora, ANWO, and Aerotop appear as complaints or listings on leak sites without full technical confirmation. The report distinguishes between confirmed encryption, a leak-site mention alone, and cases that cannot be classified, because not every claim proves an effective intrusion.

Why does the PHP alert matter if no Chilean victim was identified?

Because the ANCI alert, together with CISA and the Canadian Centre for Cyber Security, confirmed active exploitation of CVE-2026-109618 and CVE-2026-109619. That affects any Chilean organization with exposed PHP services, even if the month’s material does not identify a specific local victim. The vulnerability section summarizes the technical risk.

How are financial fraud cases linked to October’s regulatory measures?

They are linked through the need to verify identity, authentication, and traceability. The CMF sanctioned and filed complaints in cases tied to poor information handling and allegedly fraudulent online loans, while ChileCompra and ANCI advanced clauses, MFA, and security rules. The overlap between fraud and regulation appears in the threat and compliance sections.

Which sector should a Chilean CISO look at first after this month?

Energy, followed by finance and health. Energy was marked by Huatacondo and by the persistence of operational impact, finance by pressure from fraud, phishing, and identity controls, and health by the leak involving the Hospital Clínico de la U. de Chile. The report’s sector breakdown shows why those three fronts take priority.

Does the drop in cases compared with September mean less real risk?

Not necessarily. The number of verified events fell and the mix changed, but incidents did not disappear, nor did active vulnerability exploitation. Also, a zero indicator or one without a comparison does not mean there is no risk in the region, only that there is no record of it in the material analyzed for this month.

Material limitations

This report was prepared exclusively from the material provided for Chile in October 2026. The reporting window covered 44 dated items from October 2026, plus 2 items from earlier months used only as comparative context and not counted toward the monthly total. No internet sources or materials outside the approved list were used.

An indicator at 0, especially in CVEs or in categories with no comparable data, means it did not appear in the material analyzed for this period, not that the phenomenon does not exist in the region. Likewise, a claim in a leak site does not by itself amount to a confirmed breach, and vendor telemetry is not counted as an incident if there is no evidence of intrusion.

Items without a confirmed date were excluded from the count, and aggregated telemetry was not used because the material did not include figures for attempts or blocks. Consumer social media and posts on LinkedIn, Facebook, Instagram, TikTok, Threads, or Reddit were also not treated as valid evidence. When a source was commercial, promotional, or sponsored content, it was not used as the basis for trends and was mentioned only when the material presented it as an attributed claim.