Retail, E-commerce and Consumer Goods, July 2026

Threats and Active Campaigns

Ransomware and extortion

The month produced 13 cases with ransomware or extortion as the main focus, but only in some of them does the material clearly identify the exact type of impact. That distinction matters. It is not a good idea to lump together asset encryption, exfiltration without encryption, and a simple mention on a leak site, because each form calls for different responses and carries different operational consequences.

In the verifiable cases, asset encryption was confirmed in 2 cases. The material available on Ecopetrol indicates that a ransomware attempt was blocked by the company’s cybersecurity controls and those of its subsidiaries, which does not mean encryption succeeded. In the case of Caixa lottery outlets, there is also no public evidence in the material of encryption on the systems, but rather rerouted activity, offline terminals, and unauthorized transactions. For that reason, the month’s dominant pattern was not classic mass-encryption ransomware, but a mix of extortion with pressure over data and, to a lesser extent, transactional disruption.

A mere mention on a leak site appears in 3 cases. Micropack was claimed by LockBit 5.0, Mercado Libre Argentina was listed by The Gentlemen without public proof of a successful intrusion, and a Uruguayan food and services entity was claimed by Section9 without official confirmation. That set is especially relevant for retail because leak sites work as a pressure tool on companies with high reputational and operational exposure. Often, the damage does not begin with encryption, but with the public threat of data exposure, which can affect customers, suppliers, and payment channels even before any technical confirmation.

Cases that cannot be classified with the available material reach 8. That is not a weakness in the report, but a sign of how much extortion activity is published today. Attackers announce, but do not always show. Secondary media report the claim, but do not provide enough evidence to distinguish between encryption, exfiltration, or simple pressure. For a retail CISO, this means not stopping at the ransomware label. The key questions are what type of damage is already visible, what could materialize later, and which controls activate at each phase of the attack.

Fraud and phishing

The fraud and phishing block was led by 8 documented cases and by confirmation that phishing remains the most frequent vector in Latin America according to ESET, with 73% of surveyed organizations affected in its Security Report 2026. Although that figure comes from a survey and not from incidents during the period, it helps explain why so many events in the month revolve around payments, credentials, and misuse of interfaces.

Brazil showed a particularly telling variant with reported use of fake payment PDFs that imitated e-commerce brands and banking institutions to target boleto payments. Cointelegraph Brasil’s secondary coverage does not allow that description to be taken as a confirmed broad trend, but it does support a plausible attack hypothesis consistent with the local payments ecosystem. In retail and mass consumer markets, fraud of this kind is highly effective because it exploits familiar user habits, payment urgency, and trust in document formats people recognize.

Uruguay, meanwhile, showed computer fraud in a more traditional form, with card theft, fraudulent transactions, and an international gang dismantled. For the vertical, that is a direct warning. Not every loss enters through an endpoint. Part of the risk comes through the point of sale, the physical card, the marketplace, and last-mile logistics. Anti-fraud defenses need to look at the full cycle, from authentication to financial reconciliation.

APT and hacktivism

In July, there was not a large volume of classic APT campaigns solidly attributed to the retail and mass consumer axis, but there was pressure from extortion actors with an organized narrative and a broader campaign that Kaspersky described as StrikeShark, observed against organizations in Latin America, Asia, and Europe, with cases in Colombia among the countries mentioned. The available material does not tie it directly to retail, but it does point to a regional climate of more persistent operations and greater use of malicious artifacts and evasion.

The useful reading for this vertical is that campaigns that look less noisy can still reach back office systems, suppliers, or corporate accounts that support sales platforms. When attention is focused only on the cash register endpoint or the public website, it is easy to overlook that many of the more serious intrusions begin through email, documents, fake updates, or vulnerabilities in collaboration and administration software.

Critical vulnerabilities

The material analyzed did record critical CVEs mentioned during July, so it would not be accurate to say there was no technical exposure. What can be said is that the period featured several alerts about active exploitation in products widely used in corporate environments. CISA added CVE-2026-48282 in Adobe ColdFusion to the KEV catalog, and later incorporated flaws in Fortinet FortiSandbox and Microsoft SharePoint. In addition, Microsoft’s July 2026 bulletin confirmed by the Uruguayan government said that CVE-2026-56155 in Active Directory Federation Services and CVE-2026-56164 in SharePoint Server were actively exploited and included in KEV, although those facts are not part of the critical CVE count for the period because the indicator provided sets the figure at 4 mentions.

For retail and mass consumer environments, the message is straightforward. Many platforms that support promotions, supplier portals, intranets, document management, and internal publishing rely on products like SharePoint, Office, .NET, SQL Server, or federated access components. If those services are exposed, attackers have an entry point that does not require extraordinary creativity. Automation, a proven exploit, and a slow patch window are enough. The risk is not only the initial intrusion, but also the possibility that a compromise in enterprise software can spread to credentials, internal documents, and systems that support the business.

Regulation and Compliance

July also brought two developments with regulatory and institutional coordination implications. In Ecopetrol's case, the company worked with Colombia's Attorney General's Office and MinTIC to try to remove information illegally published by the attackers. That step reflects a response that is no longer purely technical, but also legal, reputational, and content management related. In incidents involving exfiltration, the ability to coordinate with authorities and data distribution platforms becomes part of containment.

The other front was Uruguay, where the Ministry of the Interior reported that two people were formally charged with aggravated theft and computer fraud, with pretrial detention ordered. The case is valuable because it shows coordination between financial investigations, prosecutors, and evidence obtained in physical spaces. For retail and mass consumer companies, the signal is that anti-fraud units must be ready to work with prosecutors, banks, and investigative bodies. It is not just a matter of reporting losses, but of preserving evidence, reconstructing payment paths, and safeguarding logs, cameras, and access records.

At the compliance level, the month also reinforced pressure from incident reporting and management frameworks. Ecopetrol's filing reports with the SEC underscores that events involving exfiltration or potential material impact cannot remain within the internal sphere. For companies with regional presence and mixed retail, distribution, or payments operations, coordination with reporting frameworks in each jurisdiction remains an operational requirement, not a legal formality.

Countries and most affected subsegments

Brazil

Brazil posted the most visible signal in this axis during July, mainly because of the Caixa lottery terminal incident. The mix of terminals going down, unauthorized payments, unrecognized transfers, and temporary operating restrictions points to a specific risk around physical payment channels and close-range payment infrastructure. The impact across at least five states broadens the read from a local incident to a platform weakness.

Regional media coverage also placed Brazil as the country with the most ransomware victims in the first half of 2026, and as the most affected in FortiGuard Labs telemetry cited by Infobae México. Those figures are not incidents from the month, but they do reinforce the Brazilian market’s priority within the regional map.

Argentina

Argentina was defined by two different signals. The first was Micropack, a food and retail goods distributor claimed by LockBit 5.0. The second was the listing of Mercado Libre Argentina on The Gentlemen’s leak portal without public proof of a successful intrusion. Between the two, the month showed both supply chain exposure and narrative pressure on a central digital commerce platform.

The most exposed subsegment in the country is not only e-commerce, but distribution and marketplace operations. That pairing puts continuity of logistics, customer trust, account availability, and protection of internal and commercial data at the center of the risk picture. When a major player such as Mercado Libre appears in an extortion attribution, even if unconfirmed, the noise spreads to users, sellers, and platform partners.

Colombia

Colombia concentrated the most complex corporate leak case, with Ecopetrol at the center. Even though it is not a retailer, the incident matters for mass consumption because it affects cloud environments, vendors, financial partners, and customer networks. The country also appears in regional attack-frequency coverage, with more than 3.000 cyberattacks per week reported by Infobae Colombia and with a presence in Kaspersky’s StrikeShark campaign.

The sector reading for Colombia points to corporate environments with deep third-party integration and a high risk of sensitive data exfiltration. In the retail axis, that translates into close attention to supplier portals, loyalty systems, integrations with partners, and cloud platforms that support commercial operations.

Uruguay

Uruguay delivered the most visible face of digital fraud. The formal charges against two people for aggravated theft and computer fraud, along with the investigation into card theft for purchases and fraudulent transactions, show a criminal economy that combines physical presence with digital abuse. At the same time, an unconfirmed claim appeared about a food and services entity linked to Section9.

For mass consumption, Uruguay sends a clear signal about the value of physical and transactional evidence. Cameras, purchase traceability, usage pattern monitoring, and cooperation with authorities were key. In a country with a smaller market than others in the region, response efficiency can be an advantage, but it does not reduce the need for stronger anti-fraud controls in merchants, marketplaces, and payment points.

Mass consumption and commerce subsegments

The most exposed subsegments of the month were food distribution, marketplaces, payment points, lotteries, and close-range payments. Micropack represents the supply chain. Mercado Libre reflects the digital platform and seller economy. Caixa lottery terminals show the risk in physical payment channels. Uruguay points to card and purchase fraud. Taken together, the vertical was shaped by the same logic, high-volume business with heavy transaction turnover and third-party dependencies.

Trends and signals to watch

There is no month-over-month baseline, because this is the first archived period with this indicator format for Latin America. That makes it impossible to say whether July rose or fell versus June within the same framework. What can be said is that the month brought a particularly dense mix of extortion, fraud and vulnerability exposure, with geographic spread across Brazil, Argentina, Colombia and Uruguay.

The first signal to watch is the shift from mass encryption to pressure over data and reputation. In July, the most visible side of ransomware was not a wave of confirmed encryption, but mentions on leak sites, threats to publish data, and exfiltration with potential legal and financial damage. For retail and mass consumer businesses, that shift is critical because attackers know the sector depends on trust, availability and transaction volume. They do not need to destroy everything to force a negotiation.

The second signal is the persistence of fraud as a parallel layer to cyberattacks. Brazil, with boleto payments and lotteries, Uruguay, with card theft, and references to fake payment PDFs show that criminal business does not make much distinction between hacking and fraud if the outcome can be monetized. For the sector, that means security and anti-fraud teams have to work together. They are different disciplines, but in July they behaved like a single risk surface.

The third signal is the exploitation of enterprise software. Even if the vertical does not always appear at the top of KEV reports, its infrastructure still depends on SharePoint, ColdFusion, Fortinet, Microsoft and other components that are not specific to retail, but do support the business. The risk is not only at the cash register or in the online store. It also sits in the collaboration, authentication and management layer that connects employees, vendors and partners.

The fourth signal is the fragility of in-person payments and intermediary channels. Caixa lottery outlets show that disruption to terminals and authorizations can create direct losses and affect deposits, tickets and transfers. In Latin America, where a large share of mass retail still relies on mixed payment schemes, that fragility becomes a business continuity issue, not just a cybersecurity one.

Security team recommendations

First, strictly separate payment, authentication, administration and analytics domains. This month showed that a disruption in a payment channel or a collaboration layer can escalate quickly if permissions are mixed. In retail and mass consumer goods, that means reviewing network segmentation, privileged identities, access federation and data egress paths. The goal is not only to prevent intrusion, but to contain the blast radius if a vendor, user or credential is compromised.

Second, strengthen fraud detection at the point of sale and in digital channels with rules that correlate transactional and behavioral signals. The cases in Brazil and Uruguay are a reminder that fraud can come through unauthorized payments, card theft, duplicate receipts or ticket manipulation. Teams should review anomalous patterns by geography, time of day, amount, terminal, source account and device. Where there is a marketplace, it is also worth monitoring sessions, password changes, account takeovers and promotional abuse.

Third, treat any mention on a leak site as a first-class event, even if the intrusion has not been confirmed. Micropack, Mercado Libre and the Uruguayan entity claimed by Section9 show that public exposure is already an operational risk. The response plan should include technical validation, internal communication, brand monitoring, searches for exposed credentials and coordination with legal and communications teams. Lack of public confirmation does not mean lack of risk.

Fourth, prioritize patching and hardening for the products that appear with active exploitation in KEV. SharePoint, ColdFusion and Fortinet are not technical anecdotes. They are potential initial access surfaces for corporate environments, and the vertical depends on them for internal workflows, collaboration and service exposure. The recommendation here is operational: live inventory, short patching SLA, minimal exceptions and post-patch validation of external exposure.

Fifth, prepare the business for continuity without blind dependence on third parties. The case of Caixa lottery retailers and the exposure across multiple Ecopetrol subsidiaries indicate that third parties, subsidiaries and distributed channels can be the weak point. The continuity plan should include manual contingencies, alternative payment routes, SLA review, terminal outage drills and the ability to operate with controlled degradation for several hours or days.

Sixth, preserve evidence from the first minute. Uruguay showed that cameras, traceability and coordination with financial investigations were useful in dismantling a fraud ring. In retail cyber incidents, that translates into preserving authentication logs, payment records, terminal images, tickets, branch cameras and change traceability. If evidence is lost, the ability to recover funds or reconstruct the attack sequence is lost as well.

Seventh, bring together security, anti-fraud, operations, legal and customer experience teams. In this vertical, an intrusion rarely stays in the SOC. It ends up affecting sales, payments, reputation and customer service. That is why the crisis committee should be able to decide quickly whether the issue is an outage, extortion or fraud, and should have ready-made communication guidelines for each scenario.

Material limitations

This report was built exclusively from the material provided for July 2026 and with a thematic scope covering retail, e-commerce, and mass consumption in Latin America. There was no access to the internet or to sources outside the authorized list. That means the picture is accurate with respect to what was verified in the material, but it does not capture everything that happened in the region during the month.

The time window for the indicators is limited to events dated in July 2026. The 6 events without confirmed dates were excluded from the indicators, although they may have been used as qualitative context. Aggregated telemetry figures were also left out, because they represent attempts, blocks, or weekly vendor averages, not incidents with confirmed impact. They were not counted in any event totals for the period.

An indicator of 0 does not mean the event did not occur in the region. It means only that it did not appear in the analyzed material with the required classification or confirmation. This distinction is especially important for CVEs and for categories such as ransomware, where part of the activity may have fallen outside the available corpus or the public evidence collected.

The material also excluded consumer social networks and sponsored content or press releases that were not suitable for supporting trend analysis. When any statement came from secondary coverage or from an unconfirmed attribution, it was treated as such and not as a fully verified technical fact. In several ransomware or leak site cases, the available coverage made it possible to record the claim, but not to verify intrusion, exfiltration, or encryption. That limit is deliberate and part of the report’s integrity.

Final Operational Notes

The month showed that risk for retail and mass consumer businesses in Latin America is not concentrating in a single vector. Physical fraud, manipulated payments, extortion narratives, data leaks, enterprise software exploitation, and pressure on third parties are all present at once. Defense that looks only at the e-commerce portal or only at the checkout endpoint arrives too late. The real exposure sits in the combination of identities, payments, vendors, cloud, and reputation.

Attention indicators