Peru Cybersecurity Snapshot: October 2026

Threats and active campaigns in Peru

Ransomware and extortion, a signal more scattered than in September

October recorded five cases with ransomware or extortion as the primary focus, but the material did not support turning them all into a single operational pattern. Only one case allowed confirmation of asset encryption, one remained a simple mention on a leak site, and three lacked enough detail to separate exfiltration, extortion pressure, or a simple claim of responsibility.

Interseguro showed the most complete combination of verifiable elements, unauthorized access, corporate response, and a later appearance on a leak portal. In other cases, such as Belcorp, Segres Systec, Confipetrol, Grifos Espinoza, Transportes Jiménez and Reyes Jim Rey S.A., Asisken Asistencia Médica S.A., or the Hermilio Valdizán Hospital, the material moved between a claim, a mention, and a lack of confirming detail.

That makes the category numerically smaller than in the previous month, but not necessarily less concerning. It suggests extortion remained active, even if the material reviewed produced more noise than hard verification.

Fraud and phishing, more visible than in the previous month

The month ended with four documented fraud or phishing cases, above the previous month. The strongest signal came from impersonation and social engineering, with warnings from Reniec about the risk of photographing or handing over the DNI, and reports of scams built on fake messages, verification codes, or synthetic identities.

The National Police also intervened in an international computer fraud case that led to the arrest of two alleged members of Los Cyber Fake del Oriente. According to the PNP, the case began with the theft of USD 10.096 from a Moldovan woman and later expanded to 111 additional operations reported as international fraud totaling USD 34.952, tied to victims in seven countries.

Along the same lines, the Experian study cited by Diario Correo said 74% of surveyed Peruvian consumers reported receiving at least one fraud attempt in the previous 12 months, and 92% feared scams involving artificial intelligence. That figure reflects user perception and experience, not corporate incidents, but it helps explain the pressure the month placed on banking, identity, and customer service channels.

APT, espionage, and influence campaigns

There was no locally confirmed APT campaign with the weight of the breach and fraud cases, but there were signs of infrastructure abuse and information deception. OpenAI and NBC News documented a Russian operation that used fake emails to trick schools in Peru and Ecuador, including local political and educational references.

At the same time, the view that Peru remains a recurring target in regional campaigns with an influence or espionage component was reinforced. ESET and other coverage placed the country within a broader Latin American map of offensive activity, although without turning those mentions into verifiable local incidents for this month.

Critical vulnerabilities affecting Peru

The month’s vulnerability focus centered on PHP2Shell, with two critical CVEs cited and a coordinated patching response at international scale. In the material reviewed, no other critical CVEs appeared with the same clarity or with better documented local impact.

The two flaws affected broad PHP branches and demanded priority attention for internet-exposed services. The operational value of the warning was not only in the high CVSS score, but in the type of deployment affected, especially installations that process web requests directly.

Regulation and compliance in Peru

Peru closed October with four documented regulatory moves, fewer than in September, but with greater strategic weight in some areas. The month centered on digital payments, open finance, artificial intelligence, and legislative powers to strengthen the response to cybercrime and other offenses.

Congress approved Law No. 32743, which delegates powers to the Executive Branch for 90 days and authorizes updates to the Computer Crimes Law, as well as adjustments to rules on computer fraud, unlawful access, and identity theft. It also authorized technical interoperability and security requirements for public platforms, plus security and incident management rules proportional to risk in the private sector.

In the financial sector, the SBS released for public comment the draft General Regulation of the Open Finance System. The rule proposes data sharing with user consent, requirements for information integrity, governance, data quality, and mechanisms to suspend authorizations if security risks emerge.

The BCRP, for its part, approved the Regulation for the Payment Acceptance Service for merchants and payment service providers. The framework includes information security, risk and fraud management, complaint handling, and transaction retention under security measures. On the same agenda, the PCM approved a directive on the profile and responsibilities of the Artificial Intelligence Officer in public entities, with provisions on security and data protection.

Most affected sectors in Peru

The seven sectors with at least one documented incident show a month that was broader than concentrated, although a few clear pressure points emerged. Finance, health, the public sector, telecommunications, energy, retail, and transportation were all affected by different signals, from breaches to regulation and resilient infrastructure.

The financial sector was the most visible, because of Interseguro, the debate over fraud, and the expansion of open finance. There was not only a concrete breach, but also renewed discussion about consent, traceability, and risk control. That overlap between incident and regulation explains why the sector drew so much attention.

Health was also exposed, although the evidence was of mixed quality. Interseguro does not belong to the health sector, but the month included mentions of EsSalud, Hospital Hermilio Valdizán, and Asisken Asistencia Médica S.A., with material that in several cases was not enough to confirm the scope or whether an intrusion occurred. The public sector carried its own weight because of alerts from the CNSD and ONP, along with legislative work on state cybersecurity.

In telecommunications and energy, the focus was more on resilience and infrastructure than on confirmed intrusion. Entel reinforced backup data routes, while ACCIONA opened a control center to monitor electric projects with AI. These are different signals from a breach, but they matter because they show operational continuity responses in sensitive sectors.

Trends and signals to watch in Peru

Compared with September, October showed a notable shift in the month’s structure. Ransomware or extortion cases as the primary focus fell from 13 to 5, while unlabeled incidents rose sharply from 7 to 20, and fraud and phishing also increased from 1 to 4. The result is less emphasis on visible extortion and more weight on exposure, investigation, and incomplete reporting.

The other major shift was regulatory. In September, the volume of rules had been higher, but in October the decisions were more closely tied to security architecture, not just legal procedure. Law No. 32743, SBS open finance, the BCRP payments regulation, and the PCM AI directive point to a country trying to bring order to its digital surface while gaps and abuse continue to appear.

The sector view also changed. October expanded the number of affected sectors from five to seven, suggesting greater geographic and functional dispersion of incidents, though not necessarily greater severity in each case. The absence of a single dominant campaign means closer attention is needed on the buildup of medium-scale events, not only the headline cases.

On vulnerabilities, the fact that only two critical CVEs were mentioned does not mean the technical risk was low. It means that, in the material analyzed, only those two reached enough consensus on impact, potential exploitation, and institutional response. The PHP2Shell alert should stay on the radar through November, especially in exposed services and public systems without mature patching.

Security recommendations for teams in Peru

First, prioritize patching and exposure hunting in PHP wherever public web services are running. CVE-2026-109618 and CVE-2026-109619 warrant version review, temporary isolation if updates are not possible, and log verification in Apache, PHP-FPM, php-cgi, and equivalent environments.

Second, review incident response procedures for partial data leaks. The Interseguro case showed that an organization can contain access, rotate credentials, activate monitoring, and still face pressure from a leak site and regulatory oversight. That sequence should be tested before it happens, not during it.

Third, strengthen identity and anti-fraud controls in support and authentication channels. The month left clear signs of social engineering, impersonation, and account theft through verification codes. That calls for properly implemented MFA, high-risk checks, monitoring of new accounts, and alerts for anomalous behavior.

Fourth, align compliance and security in regulated sectors. Open finance, digital payments, and new powers on cybercrime will increase documentation and technical demands. Paper compliance is not enough, teams must be able to demonstrate traceability, consent, fund segregation, secure retention, and timely reporting.

Fifth, strengthen internal incident classification. October showed too many cases without precise categorization. That ambiguity makes prioritization, reporting to authorities, and communication with users harder. A basic set of criteria for breaches, extortion, fraud, and availability would help organize the response.

Frequently Asked Questions

What was the relationship in Peru between Interseguro, extortion, and the regulatory response?

Interseguro concentrated three layers of the month, a confirmed unauthorized access, a Direwolf claim on a leak site, and follow-up from the SBS. The insurer said its operations remained normal, while the regulator monitored the case. For more detail, see the Relevant Incidents and Active Threats and Campaigns sections.

Were the two critical PHP vulnerabilities confirmed as exploited in Peruvian systems?

No. The month's material confirmed alerts from the CNSD and reports of attempts or scanning, but not a successful exploitation attributed to any specific Peruvian entity. The risk was technical and operational, not a locally verified incident. The details are in Critical Vulnerabilities with Impact in Peru and in Source Limitations.

What changed in fraud compared with the previous month?

The number of documented fraud or phishing cases rose from 1 to 4. The focus was on impersonation, verification code scams, and international computer fraud, including police involvement. The full comparison is in Trends and Signals to Monitor in Peru and in Relevant Incidents in Peru.

Which sectors appear most exposed in October 2026?

Finance, health, the public sector, telecommunications, energy, retail, and transportation each recorded at least one incident. Finance and the public sector drew the clearest signal, because of the Interseguro breach and the alerts and regulations issued by the PCM, the SBS, and Congress. The sector analysis is in Most Affected Sectors in Peru.

Does the drop in ransomware mean the threat went down in Peru?

Not necessarily. The number of cases with ransomware or extortion as the primary focus fell from 13 to 5, but unlabeled incidents and fraud signals increased. That may reflect a change in publication or verification methods, not a real decline in risk. See the Trends and Signals to Monitor in Peru section.

Material limitations

This report was built exclusively from the material provided for October 2026 and its comparative frame, with no internet access or additional external verification. Facts without a confirmed date were left out of the indicators and were not used for the month’s volume. Sources excluded by rule, such as consumer social media and sponsored content, were not cited as primary evidence.

The declared time window for the indicators was 55 dated facts in October 2026 and 2 facts from earlier months used only as a comparative frame. The numeric indicators in the body of the report reproduce that base exactly. When an earlier month is mentioned, it is stated explicitly in the text so comparative data is not mixed with the period’s volume.

If an indicator appears as 0, it means it was not recorded in the material analyzed for this month, not that it does not exist in the region. This nuance applies especially to CVEs and to any metric where the corpus did not allow sufficient confirmation. In the case of CVEs, the material did record two critical ones, but if in another month the indicator were 0, that would not imply the real absence of vulnerabilities in Peru or in the region.

The difference between telemetry and incidents should also be read carefully. The two aggregated figures for attempts or blocks are vendor technical noise, not intrusions with confirmed impact. For that reason, they are not added to the month’s volume and are not used to infer damage. The report distinguishes between a verified breach, a claim on a leak site, extortion, and simple technical observation.