Uruguay Cybersecurity Situation, September 2026

Relevant incidents in Uruguay

Blanco & Etcheverry and the Gunra attack

The clearest case of the month was the attack against the legal and accounting firm Blanco & Etcheverry, where the Gunra group encrypted information, demanded a ransom, and then released about 300 GB of data when payment did not materialize. The local primary source also verified the publication on the dark web, making this episode the strongest and most damaging incident of the period.

El Observador also reported that the leaked material included information on at least 35 individuals and 149 companies, according to Team Capybara's analysis. That exposure did not show credentials, keys, passwords, or specific identity documents, but it did reach a confidentiality level described as critical in the cited report.

The impact did not stop at the firm. The same coverage placed Blanco & Etcheverry as the third Uruguayan company listed by Gunra in less than three months, which suggests the group is maintaining pressure on local targets. For the country, the relevant point is not only the volume of the leak, but the repeated appearance of Uruguayan victims under the same criminal operator.

UTE impersonation scam and WhatsApp account takeovers

The Ministry of the Interior warned about a impersonation scheme in which an attacker poses as a UTE employee, asks for the victim's mobile number, and then requests the code received by SMS to take over WhatsApp. Once inside the account, the criminal asks the victim's contacts for money, turning an access fraud into a social spread scam.

Police in Rocha reported a specific case with that pattern, and Telenoche detailed that the victim received a call offering to change the meter. The attack is simple to carry out, but effective in reach: it uses trust, urgency, and reuse of the messaging channel to amplify harm.

The official response was preventive and practical. The Ministry of the Interior recommended ending suspicious calls, not sharing personal data or SMS codes, and using the Verifica service on WhatsApp. That guidance fits the threat pattern of the month, which favored user deception over technical intrusion.

Fraud conviction in Montevideo

The Ministry of the Interior reported the conviction of M.D.R.M. for two counts of computer fraud, with a six-month sentence replaced by probation. The case did not match the scale of a major corporate incident, but it did add something important to the month, a concrete court ruling under the new criminal classification.

The coverage shows how cybercrime law is beginning to organize cases that could previously have remained blurred within broader offenses. In September, that evolution was also visible in public debate about the rise in complaints, and in the distinction between fraud, cybercrime, and computer fraud.

International cooperation, digital evidence, and new tools

The Ministry of the Interior hosted a day of international cooperation on cybercrime, digital forensics, and digital evidence, with participation from authorities in Uruguay, Argentina, the United States, and UNODC. It also announced the addition of forensic tools and a 260-hour diploma program to strengthen local capabilities.

The agenda has a clear operational value: Uruguay appears to be investing in investigative capacity and evidence preservation, not only prevention. The introduction of Espejo Chubut, the software for extracting and preserving data from phones in a traceable way, points specifically to reducing friction in the handling of digital crime evidence.

Data risks in the Caranchos case

The eight-police-officer conviction in the so-called Caranchos case showed the misuse of privileged information and the leak of personal data from traffic accident victims. It is not a classic digital intrusion case, but it is an information security incident with direct consequences for confidentiality and abuse of internal access.

For the monthly reading, this episode matters because it is a reminder that part of the risk in Uruguay still comes from the improper handling of data inside institutional structures. Not all of the problem is outside, in external criminal actors.

Threats and active campaigns in Uruguay

Ransomware and extortion, with a focus on Gunra

September produced 14 cases with ransomware or extortion as the primary focus, but the details are not uniform. Only two have confirmed asset encryption, one was limited to exfiltration without encryption, two appear only as mentions on leak sites, and nine could not be classified precisely from the available material.

The Blanco & Etcheverry case is the clearest example of encryption followed by leakage. Gunra not only claimed the attack, but also published data when it did not get paid. By contrast, the available information is not enough to reconstruct the technical impact of several other claims associated with the group with precision.

That calls for caution. The presence of a name on a leak site does not, by itself, prove a breach or confirmed data theft. In September, Gunra’s activity in Uruguay was visible enough to treat it as an active campaign, but the material does not always allow a move from claim to forensic classification.

Fraud and phishing in accounts, payments, and impersonation

The month logged 9 documented fraud or phishing cases, with a pattern heavily concentrated in identity abuse and messaging. The UTE and WhatsApp scam is the clearest reference point, but it was not the only one. Official and press coverage also pointed to a rise in digital scam complaints in the country.

Coverage by la diaria and Prensa Latina describes the phenomenon as mass-scale and professionalized, with actors specialized in access, tooling, attack, and collection. The complaints data should not be read as a technical measure of intrusions, but it does signal sustained pressure on reporting and response systems.

The takeaway for security teams is direct. User authentication controls, impersonation alerts, and education about SMS codes remain basic barriers. This month’s fraud did not rely on complex malware, but on trust abuse and conversation hijacking.

APT, hacktivism, and other campaigns

The material did not show solid signs of an APT or hacktivist campaign with verifiable attribution for September. There were references to critical infrastructure, international cooperation, and protection of public entities, but not to a persistent actor with an identified campaign during the period.

That does not mean the absence of advanced threat activity, only the absence of sufficient evidence in the material reviewed. In practice, the month was dominated by extortion, leaks, and fraud, not espionage or politically motivated activity.

Critical Vulnerabilities Affecting Uruguay

In the September material reviewed, no critical CVEs were found that could be verified as linked to incidents in Uruguay. That does not mean there are no active vulnerabilities in the region, only that they were not documented in the sample used for this report.

Regulation and compliance in Uruguay

Regulatory activity was intense and covered three fronts, virtual assets, open finance, and the security of electronic operations. On Sept. 1, the BCU opened the application process for virtual asset service providers, and the framework was brought under its supervisory perimeter.

That regulatory expansion is not just formal. The process requires authorization, analysis of legality, business viability, source of funds, and the reputation of shareholders and directors. It also reinforces a key anti-money laundering principle, registering the provider is not enough, the regulator must assess who is operating and under what controls.

In parallel, the BCU Superintendency of Financial Services opened a public consultation on a draft that raises enhanced authentication requirements for card-not-present transactions and for linking electronic instruments to digital wallets. It also sets response deadlines for complaints involving foreign institutions, which brings more order to dispute handling and narrows gray areas.

The debate over open finance was the other major focus. The draft aims to share financial data through APIs, with prior, express, informed, and revocable consent, and to move practices such as screen scraping toward authorized and supervised channels. At the same time, AEBU warned that interoperability without minimum standards could increase data leaks, fraud, and other cybercrime.

The state also advanced on critical infrastructure. The critical infrastructure protection bill calls for a national registry, security plans, IDS/IPS, protocols for operational technologies and IoT, and incident notification to the state within a maximum of 12 hours. If approved as written, it would be one of the country's strictest early-notification frameworks.

The broader regulatory signal is clear. Uruguay is trying to bring order to a fast-growing financial and digital ecosystem while also tightening security and reporting requirements. That applies to banks, fintechs, virtual asset providers, and critical infrastructure operators.

Most affected sectors in Uruguay

The hardest-hit sector, based on the quality and type of incidents documented, was professional services, led by the Blanco & Etcheverry case as the clearest and most serious ransomware incident. It combined encryption, exfiltration, public leaking, and impact on clients and counterparties, a more sensitive mix than a simple leak site complaint.

The second focal point was the financial and regulated ecosystem. Not because there was a major visible banking breach this month, but because regulation, fraud complaints, and the advance of open finance put the financial system at the center of the conversation. BCU, AEBU, and SENACLAFT set the pace for the month on that front.

The public sector and citizen security also stood out. The Ministry of the Interior concentrated communications on fraud, international cooperation, digital evidence, convictions, and new forensic tools. That shows a state sector that is not only responding, but also trying to professionalize investigative capacity.

Energy and utilities showed a different dimension, one more tied to critical infrastructure and awareness. UTE and CIER put the cybersecurity of digital power grids on the agenda, although there were no concrete incidents tied to the sector during the period. The value there was preventive and coordination-focused, not reactive.

The sector breakdown also sends a negative signal. Only seven sectors had documented incidents this month, one fewer than in August, but within that relative decline the weight of fraud and ransomware cases increased. No single sector dominated everything, but there was a clear concentration in services, finance, government, and utilities.

Trends and signals to watch in Uruguay

Compared with August, total activity was higher, along with more unclassified incidents, more ransomware or extortion, and more fraud or phishing, while regulation fell as a share of the total. In figures, verified incidents rose from 49 to 67, unclassified incidents from 6 to 11, ransomware or extortion from 8 to 14, and fraud or phishing from 5 to 9. Regulation fell from 16 to 9 incidents.

That does not mean regulatory pressure eased in terms of significance. What changed was the month’s mix, with more operational events and more cases that resisted finer classification. In August, the leading threat was Regulation, with 16 of 49 incidents. In September, it shifted to Unclassified, with 24 of 67.

The decline in documented sectors, from 8 to 7, also points to a sharper concentration of signals across fewer fronts. Taken together with the increase in ransomware and fraud, that points to a month more driven by direct impact than by policy debate. The Gunra case reinforces the trend toward extortion with public exposure of data, a formula that continues to work against Uruguayan victims.

Another signal to watch closely is the gap between perception and preparedness. Radar’s study for Datasec, published by InfoNegocios, shows strong business concern, but also low formalization of policies, owners, and backups. That is consistent with a growing market, where the attack surface is expanding faster than controls.

September’s picture also offers a lesson about the state’s role. CERTuy, Interior, and BCU appear active and present, but the range of incidents suggests defense does not depend on institutional response alone. The critical issue is the operational maturity of organizations and users.

Security recommendations for teams in Uruguay

1. Review stronger authentication controls in payment channels, wallets, and non-face-to-face transactions, especially where instruments are linked to mobile devices.
2. Tighten verification procedures for calls, SMS messages, and requests for one-time codes. This month’s fraud showed that account takeover through social engineering remains the most profitable vector.
3. Prepare a clear incident workflow for possible exfiltration, because several cases this month were not fully classified, and the difference between leakage, encryption, and a leak site claim changes the legal and technical response.
4. Keep evidence logs and forensic preservation aligned with notification timelines, especially in sectors that may fall under 12-hour or 24-hour rules depending on the applicable regime.
5. Review third-party and vendor exposure, especially in open finance, virtual assets, and professional services with customer data. This month showed that damage does not always come through the traditional perimeter.
6. Confirm that backups are tested and restorable. In the September report, a significant share of the operational problem appeared as loss of control, leakage, or extortion, situations where recovery depends on both backup and traceability.
7. Train customer service, help desks, and front office teams to spot impersonation tied to utilities, banks, or support areas. If the first point of contact fails, the rest of the control comes too late.

Frequently Asked Questions

What changed between August and September in Uruguay?

Verified incidents rose from 49 to 67, ransomware or extortion cases increased from 8 to 14, and fraud or phishing cases also climbed from 5 to 9. At the same time, regulatory activity fell from 16 to 9. The full comparison is in the indicators section and in Trends and signals to monitor.

How severe was the Blanco & Etcheverry case compared with the rest of the month?

It was the clearest and most serious incident of the period, because it combined confirmed encryption, a ransom demand, and the later release of about 300 GB of information. Coverage also cited data on at least 35 individuals and 149 companies. The technical and contextual detail is in Relevant incidents and Active threats.

Why does the report say the dominant threat was "Unclassified"?

Because 24 of the month’s 67 incidents could not be more precisely categorized with the material available. That does not mean there was no risk, only that the published evidence was not enough to assign a single category with rigor. The methodological nuance is in Period indicators and Material limitations.

How do the BCU’s new rules relate to the month’s fraud?

The reinforced authentication, complaints, and open finance rules are meant to reduce exactly the risks the month exposed: impersonation, misuse of data, and unauthorized activity. The link between regulation and threats appears in Regulation and compliance, along with the WhatsApp scam and the virtual assets agenda.

Were any critical vulnerabilities exploited in Uruguay during September?

No documented critical CVEs appeared in the material analyzed for this month. That does not mean there were no vulnerabilities regionally, only that none were recorded in the sample used for the report. The chart and its scope are in Critical vulnerabilities affecting Uruguay and Material limitations.

Material limitations

This report was built exclusively from the material provided for Uruguay in September 2026. Facts from the comparison block for prior months were used only for contrast, never as part of the month’s volume, and facts without a confirmed date were left out of the indicators, although they could be mentioned as context if they added qualitative value.

The critical CVE indicator is listed as zero because none appeared in the September material analyzed. That does not mean there were no critical vulnerabilities in the region, much less that there was no active exploitation outside this sample.

Aggregated telemetry such as incidents or blocks was also not included, because the material does not provide figures of that kind. Attempts, scans, or automated blocks, even if they existed in other sources, are not counted as incidents in this report.

Sources excluded by editorial rule or format were not used as evidence: consumer social networks, sponsored posts, commercial press releases, and material not included in the list of available sources. When a claim came from a news report on outside figures or from a source with uncertain attribution, it was kept with the appropriate level of caution.