Peru: cybersecurity landscape, July 2026

Relevant Incidents in Peru

Ingemmet and the Petitorio Online outage

The month’s clearest case involved the Geological, Mining and Metallurgical Institute. PCM said a ransomware attack hit its digital services, forced the suspension of Petitorio Online, and shifted mining petition intake back to in-person processing. The same statement said the country’s geological and mining information was protected, and added that the complaint was filed with Divindat of the PNP. It also said the state ruled out paying a ransom.

That set of signals makes it the period’s most operationally clear incident. There is no ambiguity about the service impact, and none about the initial institutional response. SIDEMCAT resumed operations on July 19, but the core service was still suspended on that date. For defense teams, the case leaves a simple, hard lesson: when ransomware hits a public filing service, the cost is not just lost availability, but administrative friction that forces a return to manual processes.

Famesa and Qilin’s public claim

Famesa was claimed by Qilin on the leak site and in several monitoring aggregators. The available material confirms the company’s appearance on the leak site and its association with Peru, with discovery dated July 19 at 09:05 UTC. However, the public evidence does not allow the impact to be classified with confidence. Some sources mention exfiltration of internal files, others only record the leak site post, and several stress that this is an unverified claim.

That is why the case should be read cautiously. There is not enough basis to say encryption was confirmed, nor to treat any exfiltration scope as established. What is recorded is the actor’s reputational pressure and the confirmation that a Peruvian company was again exposed in the economy of digital extortion. From a response perspective, these cases require playbooks for handling public claims, reviewing leak monitoring, and preparing legal and crisis communications before full validation exists.

Marpatech and Nova’s claim

Marpatech surfaced in the leak ecosystem as a Nova victim. Ransomware.live identified it as a target with a discovery date of July 22, and Galaxy Warden said the leak site entry indicates exfiltration of internal files, though without quantifying the volume. BreachSense, meanwhile, referred to a data leak, but without additional official support. The story is another example of a month crowded with public marks of digital extortion, with uneven levels of verification.

Triton Trading and Qilin’s post

The Triton Trading case, a financial services company, was also recorded by Qilin on its leak site and by Ransomware.live. Discovery was set for July 23, and the aggregators placed it in Peru. Unlike Ingemmet, there is no official sign of operational impact. Unlike Famesa, the leak coverage is more consistent, but the key point remains unresolved, what damage actually occurred and whether the public evidence goes beyond the actor’s claim.

Threats and active campaigns in Peru

Ransomware and extortion, with confirmed impact, public mention, and uncertain classification

The month was marked by a broad digital extortion campaign, but the quality of the evidence varies widely. Ingemmet is the only case with confirmed operational impact in the official source available. Famesa, Marpatech and Triton Trading appear at different levels of publication on leak sites and aggregators. At the same time, Ransomware.live also links Peru to Rhysida claims and references to public entities, although in that case the assessment remains at the level of actor attribution, not impact.

Famesa, Qilin and the dispute over verification

The Famesa case deserves separate treatment because it concentrates much of the methodological ambiguity of the month. The monitoring portals agree on the Qilin claim, but there is no public confirmation from the company or Peruvian authorities in the available material. Some aggregators mention a screenshot from the leak site and others refer to exfiltration, but none provides enough elements to establish whether the incident involved encryption, leakage, or only publication of the claim.

That uncertainty does not diminish the news value. On the contrary, it points to an important trend: much of the damage in ransomware no longer depends only on service disruption, but on the pressure created by publishing the supposed victim. For security teams, that means looking not only at the technical intrusion, but also at reputation management, backup status, data traceability, and coordination with legal and institutional communications.

Marpatech and exfiltration as the main public narrative

Unlike Famesa, Marpatech does appear in the material with a more explicit mention of internal file exfiltration in the context of the Nova group. Even so, the public source does not allow the volume to be quantified or the legal scope of the leak to be established. That places it in the category of simple extortion or exfiltration without encryption, but always with the caveat that the final degree of confirmation remains partial.

Identity theft and financial fraud

The SBS warned in July about an increase in reports of digital fraud linked to identity theft. The described method was classic, but still very current: obtaining personal and financial data through phishing and phone calls, then carrying out bank transactions without the customer’s authorization. The report does not offer a final tally, but it does confirm that digital scams remained one of the most active attack surfaces of the month in the financial sector.

APT, espionage and underlying technical pressure

The month’s material does not provide a formally attributed APT case for Peru. There are signs of technical pressure and the persistence of advanced threats in the regional context, but no additional verifiable facts that would support a separate APT section with a concrete national incident. As a result, July in Peru is better described by digital extortion, phishing and regulatory tightening than by an end-to-end identified APT campaign.

Critical vulnerabilities affecting Peru

The material reviewed did not mention any new critical CVEs during the period, so the table contains a single record. That does not mean exploited vulnerabilities do not exist in the region, only that they did not appear in the dated July events included in this report.

Peru Regulation and Compliance

SBS 01741-2026 and stronger incident disclosure duties

Resolution SBS N.° 01741-2026 was the month’s most visible regulatory move. It amended the Market Conduct Management Regulation and tightened obligations for banks, savings banks, and finance companies on transparency, customer service, and operational and cybersecurity incident management. The most sensitive practical change is the 24-hour deadline for public disclosure of incidents, plus direct notice to affected customers within the next 10 business days when applicable.

In parallel, several reports noted that most of the changes will only take effect 360 days after publication, opening a window to adjust processes, platforms, and systems. For security teams, the message is clear, responding well is no longer enough, they also need to document and communicate quickly, with legal traceability and operational capacity.

BaaS, instant payments, and a wider risk perimeter

Regulation for the Banking as a Service model and the Instant Payments Service with Alias expanded the regulatory perimeter. The BCRP requires directory providers and payment system entities to submit implementation, load testing, security, and continuity plans, along with incident management, communication, and reporting measures. It also requires actors that participate in prominent payment systems or agreements to seek authorization, while those involved in non-prominent agreements must register as Payment Services Entities.

Beyond the technical language, the real impact is significant. The digital payments ecosystem is facing closer scrutiny of architecture, APIs, third parties, and continuity, at the same time the month shows signs of impersonation fraud and a clear persistence of phishing. For banks and fintechs, compliance is no longer just a legal task, it is also an operational condition for sustaining trust.

Corporate governance and cybersecurity in financial services

Coverage of BaaS and the new BCRP rules highlights suitability requirements for directors and major shareholders, a business plan with financial projections, and robust risk and continuity policies. Traxxia adds that this is driving deeper due diligence on recipient fintechs, with a focus on information security, scoring, and the use of open finance data. Not a number, but it is a signal for the month, third-party oversight moved higher on the compliance agenda.

Most affected sectors in Peru

The month recorded activity in six sectors with at least one documented incident. That points to a broad footprint, though not an even one. The real weight fell on the public sector, financial services, and the technology services ecosystem tied to both. Ingemmet, the Government of Peru, and references to the MTC appear in the ransomware and leak segment, banks, savings banks, finance companies, and digital wallets account for regulation and fraud, and service and manufacturing companies linked to regional supply chains round out the picture.

The sector breakdown shows a clear tilt toward activities that depend on availability and transactional trust. That explains why the most visible incidents and regulations touched the areas where an outage or a leak is most expensive, public procedures, payments, credit, identity, and institutional reputation.

Trends and signals to watch in Peru

The month-over-month comparison shows three concrete changes. First, documented fraud and phishing cases fell from 4 in the previous month to 2 in July. That does not mean structural relief, because the vector remains very present, but it does show fewer individually documented incidents in the available material. Second, regulatory moves dropped from 10 to 1, although the only one in July was deeper and more operational than several of the earlier ones: SBS 01741-2026 and the BCRP regulation change reporting rules, continuity requirements, and the compliance perimeter. Third, sectors with documented incidents fell from 7 to 6, with a sharper concentration in the public and financial sectors.

The dominant threat shifted from incidents in the previous month to ransomware in July. That change matters because it is not just a difference in labeling. In the previous month, the picture was more dispersed, while in July the volume is organized around digital extortion and its operational ripple effects. The result is a clearer surface for analysis: less noise, more pressure on specific organizations, and a greater need for fast response to public claims.

There is also a signal worth following closely, even if it does not translate into a single high-profile incident: the continued exploitation of older vulnerabilities dating back to 2017. The material does not introduce new critical CVEs, but it does reiterate that nearly 10% of detections in Peru exploit flaws known for years. That figure, combined with the persistence of phishing and the regulatory pressure on notification and continuity, suggests the main problem is not a lack of tools, but the gap between exposure and operational maturity.

Security recommendations for teams in Peru

1. Review ransomware response procedures with a focus on service continuity, public communication, and legal coordination. The July cases show that the first critical decision is not always technical, it is also operational and reputational.
2. Adjust leak and leak site playbooks. When the impact is unclear, as in Famesa or Triton Trading, the organization needs verification capability, evidence preservation, and a response to public pressure before it has the full picture.
3. Prioritize strong authentication and identity spoofing monitoring in the financial sector. The SBS alert makes clear that phishing and calls remain effective vectors for unauthorized operations.
4. Prepare teams for the new incident communication regime. The 24 hour window requires channels, spokespeople, templates, and classification criteria to be ready before the event.
5. Review third parties, APIs, and technical dependencies in BaaS models, instant payments, and alias directories. Regulatory compliance will require evidence of information security, continuity, and testing.
6. Keep patching and hardening systems exposed to exploitation of old flaws. The CVE-2017-0199 case shows that old exploits are still active and still have a market.
7. Run tabletop exercises that bring together cybersecurity, operations, legal, and customer service. July made it very clear that incidents do not end in IT.

Material limits

This report was written exclusively from the material provided for July 2026 and considers only facts dated within that window. Facts from earlier months were used only for the explicit comparison requested, and were not added to the period total. Aggregated telemetry figures were excluded from the incident count because they reflect detections, attempts, or automated blocks, not intrusions with confirmed impact.

The critical CVE indicator is 0 in the analyzed material for the period. That means no new critical CVEs appeared in the July facts included here, not that no critical vulnerabilities were exploited in Peru or across the region. The same rule applies to other zeros or missing counts, they indicate no record in this month’s corpus, not the real absence of the phenomenon.

Sources not allowed under the editorial guidelines were also excluded, including consumer social networks, LinkedIn posts, and sponsored content when it functioned as advertising or a press release. References taken from ransomware monitoring portals, news outlets, official agencies, and regulatory documents were used only within the verification limits present in the material. When a ransomware claim was not confirmed by an official source, it was treated as such and not as a fully validated incident.

CHART placeholders

Technical limits of the corpus

The material does not include enough consistent IoCs, hashes, domains, or IPs published to build a solid technical annex without forcing interpretation. There is also no homogeneous set of TTPs accurately attributed to a single actor for the country during the period. For that reason, the technical annex of indicators of compromise and TTPs was omitted.

Operational closeout for Peru

July left Peru with an uneasy but clear mix: more ransomware pressure, tighter compliance demands, and a financial ecosystem entering a period of greater formalization of controls. The challenge is not only to detect more, but to respond better, document faster, and shorten the gap between an incident, the decision, and the communication.

Charts