Latin America Regulation and Compliance, July 2026

Active Threats and Campaigns

Ransomware and Extortion

The month’s reporting captures six cases with ransomware or extortion as the main focus. In one of them, asset encryption was confirmed, while in five the classification could not be determined precisely from the material reviewed. That distinction matters. A case with encrypted systems and operational downtime is not the same as an extortion campaign based on data theft or a simple claim on a leak site. Because the archive does not allow a precise separation in every case of whether encryption occurred, the assessment should stay conservative.

The implication for the region is twofold. First, ransomware remains a pressure tool against organizations that handle data or critical services, even if this month’s material does not support a uniform victim profile. Second, the broader regulatory push around early notification, traceability and functional accountability means that an extortion or encryption incident now carries wider legal consequences than it did a year ago. Restoring systems is not enough. Organizations must show diligence, decide whether data was exposed, document response times and anticipate reporting obligations.

Fraud and Phishing

The 39 documented fraud or phishing cases show that digital fraud remains the month’s most cross-cutting vector after regulation. The evidence is concentrated in banking, fintech and financial services, but it also includes impersonation and deception tactics that rely on social media, fake calls, urgent messages and malicious links. The Argentine case is illustrative, with BCRA, banks and media outlets detailing social engineering patterns and complaint procedures. At the same time, the debate in Mexico over digital fraud and anti-fraud agendas suggests the financial sector is seeking closer alignment between cyber incident prevention and scam control.

From a compliance standpoint, the problem does not end with spotting a scam. Organizations have to decide what friction to introduce, what identity checks to require, how to validate official channels and how to preserve complaint traceability without hurting the user experience. This month sends a clear signal, fraud is no longer treated as a commercial side issue, but as part of each entity’s regulatory posture.

APT and Hacktivism

The month’s material does not provide solid attribution for specific APT campaigns. What does appear are instances of hacktivism or symbolic intrusions, such as the case involving the Senate of Mendoza. There are also references to routine attacks against the Mendoza state government, described by officials as daily, which suggests constant pressure on public services and institutional portals. In the absence of published IoCs or TTPs, it would not be appropriate to force a more precise technical classification.

The useful takeaway for security teams is that hacktivism and opportunistic intrusion become more visible when regulatory exposure increases. Provincial cybersecurity initiatives, draft laws and public debates create spikes in attention that can be exploited by actors seeking to denounce, ridicule or destabilize reputations.

Critical vulnerabilities

The critical CVE indicator in the material analyzed is 0. No critical CVEs were recorded in the events of the period, which does not mean there were no critical vulnerabilities exploited in the region. It also does not mean there was no technical exposure, only that the July 2026 file did not include verifiable critical CVEs for this axis.

Regulation and compliance

July confirmed a trend that has been building across the region, digital security is increasingly being written in administrative, enforcement, and governance language. In Mendoza, the provincial executive and Fuerza Patria introduced two different but converging proposals aimed at institutionalizing the response. One calls for a Provincial Cybersecurity System, a specialized committee, and coordination between public and private bodies. The other introduces a more exact framework for data protection, privacy by design, designated officials for each agency, and early incident reporting. That overlap is not redundant, it reflects two ways of turning the problem into regulation, one centered on state resilience, the other on guarantees and obligations for data handling.

The technical detail in the Mendoza proposals is significant. Diario Judicial describes a data governance regime covering the full information lifecycle, with obligations for creation, storage, exchange, and secure deletion. It also points to an operational enforcement authority separate from the executive committee and a graduated sanctions regime for those who fail to meet standards, omit reports, or obstruct audits. For a public sector CISO, that means the debate is no longer at the abstract level of best practices, but at the point where administrative penalties, interconnection restrictions, and contractual actions may eventually apply. In other words, noncompliance could stop being just a finding and become an operational constraint.

Argentina’s Resolution 725/2026, which modifies police protocols for cybercrime when minors are involved, adds another layer. The focus is not corporate cybersecurity, but it does introduce restrictions and procedures when adolescents are part of the case. For any organization that operates reporting channels, support desks, or help lines involving minors, the message is straightforward, evidence handling, first contact, and preservation of sensitive information will face stricter conditions.

In Chile, the deepfake bill kept moving forward with a regulatory design that already makes compliance obligations easy to foresee. The text applies to natural and legal persons, with a particular impact on social media platforms operating in the country. It requires a legal representative in Chile, a complaints channel, and visible labels for content generated or altered with AI. It also introduces legal action to remove content and seek damages. Even though part of the penalty regime still depends on final approval and implementing regulations, the regulatory message is clear, platforms will not be treated as passive intermediaries, but as entities with active duties to manage and respond.

The other Chilean measure, Bill No. 14.767-03 on digital copyright, points in a complementary direction. Its emphasis is on technological protection measures, circumvention, and criminal liability tied to the manufacture or provision of tools that facilitate circumvention. This matters for software vendors, device distributors, and players in the creative ecosystem, because it extends the compliance perimeter to technology-enabling conduct, not just direct infringement.

The Chilean Central Bank’s official guide on theft and financial fraud reinforces a regional logic of operational transparency. Free 24/7 channels, blocking of payment methods inactive for more than 12 months, semiannual publication of affected users, amounts, and response times, plus disaggregated reporting to the Financial Market Commission. This kind of requirement does more than organize fraud response, it also pushes institutions to measure their own friction points more carefully and build stronger internal reporting.

Colombia, for its part, regulated Law 2489 of 2025 through Decree 0769 of 2026. The text establishes shared responsibility among platforms, schools, and families, and requires digital providers to identify and manage risks, adopt data protection measures, offer complaint mechanisms, and report semiannually to the Ministry of ICT. The scope is broad, covering platforms, applications, video games, AI systems, and other digital services. For the private sector, that means governance of minors is no longer a public relations issue or a product design choice, but a measurable regulatory duty. The fact that the rule targets digital violence, cyberbullying, exploitation, online sexual abuse, and inappropriate content also gives it a particularly sensitive reputational dimension.

Guatemala continued down a tougher criminal path. Bill 6347 proposes specific penalties for unlawful access, attacks on data integrity, attacks on system integrity, computer fraud, and the improper use of technological devices. Although the process remains open and the text was sent back to committee in April 2026 for technical corrections, the debate is already in motion. For companies, that means reviewing log retention, access policies, internal investigation procedures, and control documentation, because the standard that appears to be emerging is one of criminally relevant traceability.

Mexico appears in a different way. The material reviewed does not confirm a new CNBV or Banxico rule published in July, but it does show convergence between the financial market and regulators around combining cybersecurity and anti-fraud efforts. Coverage points to protecting users from digital fraud, and other texts from the month mention the use of artificial intelligence for real-time detection, the exchange of alerts with the BCRA in Argentina, and, across the region, tighter biometric and identification requirements. For compliance, the takeaway is clear, the issue is not only regulating infrastructure, but proving that authentication, monitoring, and response mechanisms do not degrade the user experience to the point of driving people toward riskier channels.

Brazil remains a structural reference for the region, although in this file the useful material was more about the broader environment than about a single regulatory act. Garrigues’ newsletter identifies sector supervisors, business associations, ministries, and major platforms as drivers of regulatory modernization in data protection and cybersecurity in Chile and Brazil. That description matches the kind of agenda seen throughout the month, regulation is no longer driven only by legislators, but by the interaction between regulators, industry, and sectors with the highest exposure to fraud, sensitive data, and large-scale digital services.

Comparative table of the month’s regulatory items

Most Affected Countries in Latin America

Argentina

Argentina saw the highest density of regulatory developments tied to this theme, especially in Mendoza and through BCRA activity. In the province, debate over the future Cybersecurity Law and an alternative data protection bill set off a broader discussion that combines state resilience, data governance, penalties for noncompliance, and mandatory incident reporting. The scope described by the sources is broad, covering state branches, third-party technology providers, and essential critical services. The presence of a provincial incident registry, an executive committee, and an operating authority points to a more mature institutional design than a simple set of best practices.

In the financial sector, the BCRA kept tightening the response process for online fraud. The value of the coverage does not lie in a single isolated notice, but in the way it consolidates a process, complaint first with the institution, detailed documentation, a minimum 10-business-day period, and then escalation to the Central Bank. In parallel, another BCRA notice clarifies procedures and services under the regime for financial institutions and PSPs, reinforcing formal, traceable handling of requests. For banks and fintechs, the message is consistent, more documentation standardization, more traceability, and less operational improvisation.

Chile

Chile maintained a dual agenda centered on digital identity protection and financial compliance. The deepfake bill moved forward with broad parliamentary support and made it clear that platforms operating in Chile will face specific duties, from appointing a legal representative to labeling synthetic content. The bill’s design aims to turn the handling of deceptive AI-generated content into a product and process obligation, not just a debate over free expression or reactive moderation.

At the same time, the digital copyright bill is also advancing. By focusing on technological protection measures and circumvention, Chile is extending the cybersecurity conversation to intangible assets, software, and technical services that facilitate infringement. Added to that is the Central Bank’s official guidance on theft and financial fraud, which strengthens compliance for banks and issuers through service hours, blocking, and reporting requirements. The country therefore stands out as one of the most active in institutionalizing response obligations across both platforms and financial services.

Colombia

Colombia had a very clear month in regulating digital environments for minors. Decree 0769 of 2026 sets obligations for platforms, apps, video games, AI systems, and other services, and requires risk management, complaint mechanisms, and semiannual reporting. The key point is the combination of shared responsibility and periodic oversight. The rule does not rely only on schools or families, but places providers among the first-tier obligated parties.

This has a direct impact on technology and edtech companies operating in the region. They are now exposed to reviews of privacy by design, reporting mechanisms, content classification, minimum access age, and internal escalation processes for complaints. This month’s material suggests that Colombia is expanding the scope of digital compliance toward child protection, an area where governance failures carry disproportionate reputational and regulatory costs.

Guatemala

Guatemala continued pushing a cybersecurity criminal reform through Initiative 6347. The intensity of the parliamentary debate, the referral back to committee for technical corrections, and the search for a joint opinion show that the country is trying to close gaps in criminal classification. Unlike other jurisdictions that focus more on administrative governance, Guatemala is moving through criminal penalties, which forces organizations to think about evidence, logs, preservation, and cooperation with authorities.

Mexico

In Mexico, the usable July material points more to sector convergence than to a specific dated rule. The financial industry is agreeing to merge cybersecurity and anti-fraud efforts to protect users, while other coverage this month addresses biometrics, identity, and fraud detection. Although the archive does not include a specific CNBV or Banxico resolution for July, it does show regulatory and reputational pressure on banks to strengthen controls, share alerts, and preserve user experience without opening new fraud gaps.

Brazil

Brazil appears less through a single move this month and more as part of the regional supervisory framework. The Garrigues newsletter places supervisory agencies and sector ministries as drivers of regulatory modernization, and the undated material confirms that the LGPD has already established a robust sanctions regime and clear grading criteria. In this report, Brazil serves as a structural reference for understanding how the region is beginning to combine data protection enforcement with technology governance in sensitive sectors.

Paraguay, Peru, Bolivia and the United States

Paraguay, Peru, and Bolivia did not concentrate most of the usable July material for this theme, although they continue to appear in the broader file with discussions on personal data, digital banking, and virtual assets. In the United States, the presence of content on platforms and cybersecurity is not part of the main geographic scope of this report, but it helps contextualize the regional flow of regulatory ideas. There is not enough verifiable density in this group to build an interpretation equivalent to the one for the countries above.

Trends and signals to watch

There is no month-over-month comparison baseline for the same set of indicators, because this is the first archived period in this format for Latin America. That makes a quantitative comparison with the previous month impossible and leaves July as an operational baseline. Even so, the contrast with CELE’s June 2026 findings, where the cybersecurity category accounted for 4.0% of projects tracked between January and June, shows the trend was already building, and in July it gained density, visibility, and specificity.

The first signal to watch is the move from broad frameworks to concrete obligations. Once an initiative starts requiring designated leads, 72-hour deadlines, incident logs, complaint channels, or semiannual reports, the impact is no longer symbolic. It affects workflows, budgets, org charts, and third-party controls. Mendoza, Chile, and Colombia are three different expressions of the same trend.

The second signal is the expansion of compliance into content, identity, and fraud. Deepfakes, impersonation, bank fraud, digital fraud, and child protection are not emerging as separate issues, but as facets of the same regulatory space. That forces security and legal teams to coordinate moderation, identity, authentication, anti-fraud measures, and evidence preservation. The risk of treating each front as a silo is high.

The third signal is the growing relevance of subnational government. The Mendoza case shows that provinces and local jurisdictions can become regulatory laboratories with a national demonstration effect. For companies with distributed operations, that means the compliance map can no longer be drawn by country alone. Provinces, sectors, and specific agencies also have to be tracked.

The fourth signal is the consolidation of fraud response as a regulatory discipline. The BCRA, the Central Bank of Chile, and the discussion in Mexico point to the same issue, the need to document, block, escalate, and report with precision. Fraud response is no longer just a support function. It is part of compliance and financial supervision.

The fifth signal is that future sanctions will not be uniform. Guatemala appears to be leaning toward criminal enforcement, Chile combines criminal, administrative, and judicial measures, Colombia regulates ongoing management duties, and Mendoza is designing administrative and contractual sanctions. Regional teams cannot import a single compliance template. They have to map by jurisdiction, by operator type, and by class of data or service.

Security team recommendations

Regional teams should treat July as a month to prepare for greater regulatory exposure, not as an anomaly. The first priority is to review incident and complaint notification workflows. If an organization handles data from citizens, minors, or financial customers, it must be able to determine within hours, not days, what happened, what information was compromised, who decides on notification, and what evidence is preserved. The 72-hour deadlines, incident logs, and semiannual reports cannot be improvised.

The second priority is to align security, legal, and customer support. Digital fraud and bank scams are no longer solved with a call to the bank or a password policy. They require response scripts, operational freezes, fraud escalation, log preservation, user communication, and, where applicable, a formal channel for the authority. If those steps are not integrated, the organization ends up responding inconsistently to both the regulator and the customer.

The third priority is to formalize data governance. The Mendoza projects and the Chilean logic of traceability show that regulators increasingly expect identified owners, inventories, documented life cycles, access controls, secure deletion, and change traceability. That applies to public agencies as well as to private vendors that provide services to them.

The fourth priority is to review product and user experience through a compliance lens. Pressure around biometrics, identity verification, reporting mechanisms, and child protection cannot be addressed by adding blind friction. Controls must be selective, measurable, and proportionate. Otherwise, users may be pushed toward riskier side channels, or the experience may degrade so much that the control itself loses effectiveness.

The fifth priority is to prepare specific responses for platforms and synthetic content. Projects on deepfakes in Chile and discussions about digital fraud in Mexico show that platforms will need to handle reports, labels, content removal, and, likely, local presence or legal representation requirements. Anyone operating with AI-generated content should already have an internal protocol to identify, classify, label, and escalate potentially unlawful material.

The sixth priority is to strengthen cooperation with third parties. Many of the month's incidents involve software, connectivity, infrastructure, or digital service providers that operate as part of the responsibility chain. Especially in the public sector, an incident does not always start inside the agency. Contracts should therefore include notification times, support obligations, evidence preservation, access to logs, and audit mechanisms.

Suggested operational response matrix

Material limits

This report was prepared exclusively from the material provided for July 2026 and the comparative frame from previous months included in the file. No internet access or additional external sources were used. The 531 verified facts from the period form the basis of all indicators, while the 28 undated facts were excluded from the calculations and used only when they added qualitative context.

The critical CVE indicator is 0 in the material analyzed. That means no critical CVEs were recorded in the July 2026 file, not that no critical vulnerabilities were exploited in the region. The absence of that data should not be read as an absence of technical risk.

There was also no aggregated telemetry in the period material. For that reason, this report does not treat attack attempts, blocks, scans, or vendor averages as incidents. The risk reading relies solely on verified facts, not on background noise filtered by defensive systems.

For indicator purposes, the material excluded facts after the period and content without a confirmed date. Social media for consumers, LinkedIn posts, sponsored content, and commercial pieces that are not within the allowed source list were also left out of the argument as primary evidence. When a claim appeared uncertain or was attributed by the source itself, it was treated as such and not elevated to editorial certainty.