Public Sector and Government Agencies, July 2026

Monthly reference modules

These modules are filled automatically with verified dated events within the period. Each one states its source base and counting criterion, so the figures reconcile across modules. They are the recurring monthly readout; the follow-up analysis expands the cases without repeating this summary.

Indicator window: 79 dated events in July 2026 · 1 from prior months (comparative frame, not monthly volume) · 4 without confirmed date (excluded from indicators). Events from prior months are used only as a comparative frame in the analysis, never as volume for this period.

Executive monthly summary

July 2026 painted a mixed picture for the public sector and government agencies in Latin America. The month was driven by availability incidents, data leaks and regulatory moves, with a clear drop in ransomware and phishing mentions compared with the previous month, but with much heavier rulemaking activity. The most consistent signal was not destructive encryption, but disrupted systems, exposed databases, unauthorized access and institutional responses aimed at putting tighter technical and legal limits on risk.

The verified volume for the period was lower than in June, but that does not amount to a straight improvement in risk. The public attack surface continued to show fragility in citizen service platforms, transparency portals, mobility systems and state support environments. In several cases, the main impact was operational and reputational, with some events lasting several days before partial restoration. Administrative and criminal investigations were added to that picture, confirming that cyber incidents in the public sector are no longer handled only as technical failures, but also as issues of institutional continuity, data stewardship and possible contractual or regulatory liability.

The highest concentration of events was seen in Colombia, Mexico, Paraguay, Brazil and Argentina, although the nature of those events differed. Colombia combined a high-profile case involving Ecopetrol with the ongoing debate over the data leak tied to mobility in Bogotá. Mexico produced a dense set of incidents in León and a series of reports about Sinaloa, still with substantial technical uncertainty in the available material. Paraguay moved between allegations of state-linked cyberespionage and the institutional response, while Brazil contributed two important signals, a data protection sanction tied to the public health system and an incident at the STM. In Mendoza, the signal was not an attack, but regulation under construction.

The relationship between incident and response also changed in tone. The previous month had been marked by more ransomware and more documented phishing, while July was dominated by the block of incidents that were not classified, with a single reference to ransomware as a contained attempt and without sufficient confirmation to classify the impact precisely. At the same time, regulatory activity expanded sharply, from a comprehensive bill in Mendoza to ANPD decisions in Brazil and actions by Colombia’s Procuraduría on cybersecurity contracting. The region is therefore showing a partial shift from purely operational reaction toward more explicit governance frameworks, although they remain highly uneven across jurisdictions.

One relevant fact from the month is that the events directly confirmed by the source reached 81 percent of the material. That improves the quality of the reading compared with publications based on weak attribution or journalistic reconstructions without full technical support. Even so, gray areas remain that require caution, especially in campaigns with complex attribution, reports with figures not verified by the authority and cases where the material does not allow a determination of whether there was encryption, exfiltration or only a claim of responsibility.

Regional overview for the month

July’s regional readout points to medium-high risk, driven less by a wave of mass destruction than by the persistence of intrusions, leaks, and service outages in essential public systems. The risk assessment rests on 41 uncategorized incidents out of 78 verified events, a set of cases with direct impact on citizen portals and sensitive data, and high-impact institutional cases involving Ecopetrol, the STM, León, Bogotá, and Paraguay. It is not a month defined by sheer volume, but by events with operational and compliance consequences that dominated the agenda.

Geographic dispersion was also notable. No single geography dominated by threat type. Mexico concentrated availability failures and leaks in local governments, Colombia combined exfiltration, regulatory pressure, and criminal investigation, Paraguay brought the hypothesis of cyberespionage against state systems to the forefront, Brazil showed its data protection authority’s response and an incident at the top military court, and Argentina began turning state cybersecurity into a formal legislative issue. That mix suggests the region is not facing one problem, but several overlapping fronts, weak vendors, exposed public platforms, disputes over attribution, and uneven maturity in governance frameworks.

The balance between offense and defense also shifted. In June, extortion, fraud, and ransomware drew more attention. In July, the signal moved toward service unavailability, exfiltration, and a review of state capabilities. The inclusion of a critical alert for CVE-2026-0257 in Palo Alto GlobalProtect reinforces the idea that exposure does not depend only on the public sector as a direct victim, but also on its reliance on widely deployed infrastructure and software. The state risk surface remains tied to third parties, operating contracts, and controls that are often activated after the incident.

A maturity reading rounds out the picture. When a month brings this many regulatory mentions, it usually points to two things at once, the issue already has political weight, and the formal response is trying to catch up with a threat that appears before the solutions do. The Mendoza bill, ANPD’s sanction, the Attorney General’s warning in Colombia, and MITIC’s actions in Paraguay show that Latin American governments are moving toward more regulation, but this month’s evidence says they still arrive in the second phase, after the leak, outage, or intrusion. Prevention is still playing catch-up.

Period indicators

Relevant Incidents

Ecopetrol, data exfiltration, and corporate and state response

The month’s most visible case was the cyberattack against Ecopetrol, which combined exfiltration, attribution by a threat group, and regulatory fallout in Colombia. Reuters reported that the company detected the theft of information tied to about 3,300 user accounts and that the incident affected cloud storage environments across 15 subsidiaries. The same coverage said Ecopetrol managed to stop a ransomware attempt, but that did not make the event a simple intrusion with no consequences, because the exfiltration was confirmed and the company did not rule out possible adverse financial impact.

The response was also multi-channel. According to the corporate statement circulated by Yahoo Finance, Ecopetrol activated its response protocols, revoked unauthorized access, and deployed measures to prevent public release of the exfiltrated information. On July 28, according to El País, the company filed Form 6-K with the SEC reporting the cyberattack, and two days later the same outlet cited The Gentlemen group saying it possessed up to 1 terabyte of Ecopetrol and subsidiary data, including drilling records, payroll, banking data, medical histories, biometrics, and active VPN credentials. That chain of events matters not because of the attacker’s claimed volume, which has not been fully verified, but because it shows how a corporate incident at a strategic company can escalate into the public, regulatory, and market agenda.

Infobae added that the Fiscalía General de la Nación opened an investigation on July 31. In parallel, El Colombiano reported that ColCERT issued a high-risk alert for the business sector and that the Ministry of ICT received the report on July 17, triggering coordination with relevant agencies. The combination of a criminal investigation, a technical alert, and a filing with the financial regulator suggests the event is no longer being read as an isolated incident. For the public sector and for organizations that rely on critical contractors, the Ecopetrol case is an operational reminder about cloud exposure, access revocation, provider segmentation, and traceability of privileged accounts.

Bogotá and the mobility data leak

The incident tied to Bogotá’s District Mobility Secretariat remains relevant because it shows a classic third-party exposure pattern. According to Noticias RCN and El Tiempo, the February 2026 leak involved a historical database managed by an external technology provider, used as an internal reference source for specific operational processes. The outlets also specified that the intrusion hit the provider managing the database, rather than the Secretariat’s main infrastructure, and that at the time of reporting there was no final consolidated count of the data affected.

That did not reduce the reputational impact. Infobae reported that a group of attackers claimed access to information on nearly 4.5 million drivers in Bogotá, including personal data, licenses, SOAT, vehicles, and traffic violations, although the Secretariat did not confirm that figure. In the same information ecosystem, growing risk was flagged for phishing campaigns and scams aimed at drivers, built on exfiltrated data and personalized messages about citations and vehicles. The operational issue here is not only the leak itself, but the reuse of those data in secondary fraud, which can extend the harm long after the original incident.

Noticias RCN also reported that the technical investigations included preservation of digital evidence, traceability analysis, review of compromised systems, and formal requests to the provider to strengthen controls and deliver detailed technical reports. In addition, the District denied reports about citation tampering and impact on speed cameras. That kind of public clarification matters because it shows another feature of public sector risk: when forensic findings are incomplete, speculation, unverified claims, and political readings of the incident fill the gap. Bogotá therefore appears as a case of an exposure still being clarified, with operational, contractual, and public trust impacts.

León, portal outages, transparency, and preventive blocking

León was one of the month’s most consistent focal points in Mexico. On July 1, local media reported that the official website of the León government had gone offline because of a cyberattack that mainly affected the Citizen Services System, freezing procedures and fine payments. La Silla Rota added that data belonging to citizens may have been stolen during the incident, although it did not specify volume or technical evidence. The next day, the municipal Information Technology Directorate said that through 2026 it had recorded about 1,637,000 hack attempts against the municipal digital infrastructure, a figure that should be read as attempt telemetry and not as confirmed incidents.

The later evolution showed prolonged unavailability. AM León said the Transparency portal was still operating with limited access to files eight days after the attack and that the municipality’s main site was restored on July 6, but the Transparency portal remained disabled at least through the 7th. Contacto Noticias said the digital portal had accumulated nine days offline. That extension matters because the impact was not limited to the initial website outage, but reached accountability functions and access to required information.

The official response focused on containment. The municipality said, according to AM León, that it applied a preventive block to the computer equipment to avoid greater damage and later ran security tests before restoring services. AM also reported database leaks and municipal purchases in the context of a hack against Seguritech linked to local government services. The overall picture reflects a highly recognizable operational pattern for municipalities in the region, where the boundary between in-house systems, outside vendors, and citizen services is blurred. When an actor compromises one layer of that ecosystem, the resulting outage or leak quickly affects procedures, transparency, and public trust.

Mendoza, bill proposal, and the state cybersecurity architecture

In Argentina, the strongest signal was not an incident, but a cybersecurity bill for Mendoza. The legislative text, published by El Sol, creates the Strategic Cybersecurity Steering Committee as the enforcement authority and highest political and strategic body, chaired by the Ministry of Security and Justice and made up of other strategic provincial agencies. It also establishes an Operational Cybersecurity Authority under the same ministry, with monitoring, detection, management, and incident response functions, including operation of a provincial SOC and a government CSIRT.

The value of this initiative is that it turns into regulation a set of decisions that in other jurisdictions are often scattered or remain only as best practices. The bill requires the creation of an Inventory of Critical Information Assets of the provincial government, the classification of information, and the development of a Cybersecurity Risk Management Program based on recognized standards and best practices, including ISO/IEC 27001. It also specifies that the mandatory scope covers the Central Administration, decentralized agencies, autonomous entities, state-owned companies and corporations, and other organizations with majority state participation. It is a regulatory piece aimed at closing the gap between operational informality and the need to respond with institutional capability.

Diario San Rafael added that the initiative is aimed at protecting the state’s technology infrastructure and the personal data of Mendoza residents, and that it also includes public awareness campaigns. Although it is not a response to a specific incident, its inclusion in the report is relevant because it shows how some provinces are beginning to treat cybersecurity as critical public infrastructure, not as an accessory expense. In public policy terms, that can affect procurement, audits, provider governance, and asset prioritization.

Paraguay, cyberespionage, criminal complaint, and state attribution

Paraguay was one of the month’s most sensitive cases because of the nature of the material published. Coverage from ABC Color, DW, Diario Paraguayo, and La Tribuna said that MITIC and U.S. authorities detected infiltration by multiple China-linked threat actors into Paraguayan state systems. The available material indicates that the government described malicious cyber operations aimed at state digital platforms and that a cyberespionage complaint was filed, with the prosecutor’s office opening a criminal case.

La Tribuna published statements from Pedro Martínez, MITIC’s director general of Cybersecurity and Information Protection, saying the goal of the incident was the covert collection of data and continuous monitoring, not destruction or sabotage of the infrastructure. That distinction is key, because it shifts the reading of the case away from visible damage and toward persistence and observation. For the public sector, the threat of cyberespionage is harder to detect and harder to quantify. If the purpose is to plant a state-data collector or maintain silent access, the problem is not an immediate outage, but the possibility that the adversary remained in the network for an extended period.

ABC Color said prosecutor Irma Llano confirmed initial steps and the taking of testimony from the head of MITIC. Another report said the ministry had presented actions before the Senate to strengthen state cybersecurity, linking the complaint to an institutional response agenda. In parallel, DW reported that the United States and Paraguay detected the infiltration during a joint review. Even with the necessary caution around attribution, the case leaves an important regional signal: governments are no longer discussing only service protection, but intrusion into state networks with possible intelligence objectives.

Mato Grosso do Sul’s Detran and unavailability due to intrusion attempts

Mato Grosso do Sul’s Detran reported instability in its systems after intrusion attempts against its technology environments and clarified that there was no data breach of institutional or citizen information. Coverage from Campo Grande News added that the attempts triggered security protocols and caused intermittent failures in the connection with Sefaz. Although the material does not support describing a confirmed intrusion with exfiltration, the case fits the category of an operational incident with containment response.

The importance of the episode is not its spectacle, but its normality. Traffic agencies are recurring targets because they combine high citizen demand, dependence on integrations with other agencies, and strong sensitivity to service continuity. When the failure reaches links with the finance department or undermines system stability, the problem stops being technical and becomes direct friction for procedures, revenue collection, and public service. For the region, this kind of case is as representative as a major leak, because it reflects the everyday resilience of the state apparatus.

Brazil’s STM, portal outage, and limited scope

The Superior Military Court reported a cyber incident on its website around July 2 and temporarily took the site offline while it analyzed and restored systems. G1 said the incident affected only the institutional website and did not cause damage to internal systems or to the court’s case processing. That distinction, though it may seem small, matters greatly from an operational perspective, because it shows effective containment of scope and avoids overstating the event.

The case remains relevant for that reason. An outage of a public portal in a judicial or defense institution can affect legitimacy, access to information, and the perception of institutional security, even when internal systems remain intact. From a regional standpoint, the STM confirms that front-end unavailability remains an important signal in the public sector, especially in a month when several agencies had to block or take platforms offline to contain greater damage.