Paraguay: cybersecurity landscape, July 2026

Paraguay incident indicators for July 2026

Relevant Incidents in Paraguay

Cyber operations against Paraguayan state platforms

On July 10, MITIC and the U.S. Embassy issued a joint statement warning about malicious cyber operations targeting the Paraguayan state’s digital platforms. Subsequent coverage said a cybersecurity review of government networks identified multiple threat actors linked to the Government of the People’s Republic of China. The material also refers to unauthorized access, disruption of digital services, and the theft and disclosure of sensitive data. The source does not provide IOCs or a closed exploitation chain, but it does make clear that the matter moved from suspicion to a public complaint and a criminal case.

Criminal case over cyberattacks on the Paraguayan state

Paraguay’s Prosecutor’s Office opened a criminal case to investigate intrusions into government computer systems attributed to actors linked to China, and the investigation was assigned to specialized prosecutor Irma Llano. The key point is not only that the case was opened, but that it has now been formalized before the Public Ministry with a description of events that includes intrusion, disruption, and exposure of sensitive information. That gives the episode a legal dimension that in other countries often takes longer to reach.

Alert over cyberattack on Paraguayan clinics

Diario Paraguayo published a report on July 3 responding to an attack that affected private clinics. The text recommends isolating systems, declaring an institutional emergency, setting up a crisis committee, and preserving evidence. It does not identify institutions or malware families, but it does confirm that the local discussion was already dealing with an incident with real operational impact on private healthcare, along with prior weaknesses in patching, obsolete systems, and poor cyber hygiene.

Extortion attack against Solventa & Riskmétrica S.A.

Dexpose reported on July 1 an extortion note from the Doommageddon group against Solventa & Riskmétrica S.A., a Paraguayan credit rating agency. The publication says the group threatened to leak sensitive data if negotiations did not take place. In this case, the source clearly frames the incident as extortion, but does not publish enough detail to conclude that assets were encrypted.

Threats and active campaigns in Paraguay

Ransomware and extortion, with uneven impact

Confirmed asset encryption

Ransomware.live listed Automovil Supply S.A. as a victim of the TheGentlemen group, with the case discovered on July 7 and the estimated attack date set for July 6. That record is what supports confirmed encryption within the month, alongside reporting on the response to the sanatorium case, where the journalistic material suggests operational impact but does not fully identify the family or the technical scope. The July report on the automotive company is more clearly classified by the intelligence platform.

Mention only on a leak site

The Solventa & Riskmétrica S.A. case falls into the extortion category with publication on a leak site, because Dexpose reports a Doommageddon note threatening to publish data, but the material provided does not allow confirmation that encryption was verified.

Typing cannot be determined from the material

In the sanatorium case, the documentation speaks of a cyberattack that prompted an institutional response, and a secondary source that cannot be used as primary evidence suggests a move to paper records. With the material fit for citation, there is not enough to determine whether this was encryption, exfiltration, or a mix of both. For that reason, it should remain classified as undetermined.

Cyberespionage attributed to China-linked actors

The other active line this month was state-linked and geopolitical. Coverage from ABC Color, Infobae, La Política Online, Swissinfo and other outlets converges on a joint Paraguay and United States complaint over infiltration of government networks, a Chinese response denying the allegations, and an expanded case at the prosecutor’s office. The reporting links the campaign to Flax Typhoon in the 2024 background and to new actors detected in 2026, although that technical attribution is supported by joint reviews and official statements, not by a public forensic release.

Fraud and phishing

No fraud or phishing cases were documented in the period material.

Critical vulnerabilities with impact in Paraguay

Regulation and compliance in Paraguay

Paraguay moved in July on a regulatory agenda with direct implications for privacy and operational oversight. The new Personal Data Law adds rights of access, rectification, deletion, objection, portability and review of automated decisions. It also requires data minimization, establishes a free procedure for citizens and provides for breach notification within 72 hours when applicable. Enforcement and supervision will fall to the National Personal Data Protection Agency, under MITIC.

ABC Color also reported the phased penalty regime, with fines ranging from 20 to 2,500 jornales for general violations, up to 5,000 for sensitive data and up to 10,000 when children or adolescents are involved. The press also said the law will take full effect in 2027, giving organizations a reasonably short preparation window for inventories, contract reviews, privacy policy updates, stronger controls and staff training.

At the same time, Congress received a bill to regulate drones with mandatory registration before DINAC, the Air Force or Digemabel, depending on use, plus remote electronic identification. While not a cybersecurity rule in the strict sense, it is tied to traceability, technical control and possible system interoperability. The BCP also advanced work on SIPAP fees, new maximum card commissions and transparency rules for payment services, a package that keeps pushing the financial system toward digitization under tighter oversight.

Most affected sectors in Paraguay

The month produced incidents across six sectors, though not with the same intensity or quality of evidence. The public sector carried the heaviest strategic burden because of the cyberespionage case and the mention of compromised government networks. The private sector, meanwhile, stood out for extortion and ransomware, especially in automotive, risk rating, and medical centers.

Banking and financial services also remained in view, though more because of regulation, technology risk, and cybersecurity debate than because of a specific incident. The Paraguayan Banking Convention 2026 added AI, cybersecurity, and digital vulnerability as central themes, while the BCP continued to set fees, payments, and risk-based supervision. That suggests the sector did not face a discrete crisis, but it did face sustained pressure to strengthen controls and governance.

Healthcare was the other sensitive sector during the month. References to medical centers, outdated systems, unpatched vulnerabilities, and the need for crisis response show that the problem was not only malware, but preparedness. The available text also suggests that the affected organizations were already carrying accumulated weaknesses, which often makes recovery harder and prolongs disruption.

Trends and signals to watch in Paraguay

Compared with June, July showed a lower total volume of verified events, but more unclassified incidents and a sharp drop in regulatory activity. That does not point to a reduction in risk. It points to a month centered on high-interest incidents and political signals, with less compliance coverage than the previous month. The drop in ransomware or extortion cases from 18 to 11 does not ease the pressure, because those 11 still include confirmed encryption, leak sites and undetermined cases.

The most important signal to watch is the consolidation of the state layer. When an intrusion moves from a diplomatic complaint to a criminal case, it is no longer just a technical matter. Paraguay also ended up in a debate over attribution, digital sovereignty and the security of government networks that is likely to continue in August, especially if new details emerge about scope or affected infrastructure.

It is also worth watching whether July was an isolated peak or the start of a period of greater extortion pressure on private sectors. Automotive, health and risk rating do not belong to the same vertical, but they do share broad exposure and reputational leverage. If the trend continues, the most likely pattern is not a single dominant group, but opportunistic campaigns against targets with low tolerance for disruption.

Compared with June, the clearest shift is qualitative, not numerical, fewer regulatory initiatives, more pressure from ambiguous incidents and a much more mature public discussion about personal data. There is no CVE baseline for comparison, because none were recorded in the material analyzed in July. That should be read as a lack of mention, not as a lack of exploitation in the region.

Security recommendations for teams in Paraguay

1. Review remote access and require multifactor authentication on VPNs and administrative consoles, especially in government environments and critical vendor operations.
2. Prioritize data inventory, contract review, updates to privacy policies and records of processing, in line with the new Personal Data Law.
3. Prepare specific extortion playbooks, with evidence preservation, asset segmentation, backup validation and decision thresholds for operational continuity.
4. In health care and services with high availability dependence, verify that response plans account for legacy systems, pending patches and degraded operations.
5. For public entities, strengthen identity monitoring, access correlation and change traceability, since the month’s material suggests persistent intrusion rather than opportunistic noise.
6. In the financial sector, speed up alignment between compliance, cybersecurity and third-party management, because the regulatory agenda and payment services kept moving at the same time.
7. Do not treat extortion as a synonym for ransomware. Separating encryption, exfiltration and a simple mention on a leak site improves prioritization and avoids responses that are oversized or, on the other hand, underestimated.

Material limitations

This report was built exclusively from the material provided for Paraguay in July 2026. The facts in the main block are the only ones counted for the period indicators. Facts from previous months were used only as comparative context and should always be read as background, not as July volume. Unconfirmed-dated facts were excluded from the indicators, although they could be used as qualitative context when the source allowed it.

A zero indicator, especially for critical CVEs, means there was no record in the analyzed material during this month. It does not mean that no critical vulnerabilities were exploited in the region or in the country, only that they did not appear in the available July corpus. The same applies to fraud and phishing, their absence in the indicators reflects the material, not the full threat landscape.

The declared time window for the indicators included 51 dated events in July 2026, 3 events from previous months as comparative context, and 11 events without confirmed dates excluded from the counts. Aggregated telemetry, such as automated attempts or blocks, was not used to count incidents or infer severity.

Consumer social networks, sponsored content, and advertorials were also left out of the quantitative body. References to LinkedIn, YouTube, or other spaces not included in the list of available sources were not used as primary evidence. When a claim depended on unresolved journalistic attribution, it was identified as such and not treated as technical certainty.