Public Sector and Government Agencies, Aug 2026

Monthly reference modules

These modules are automatically filled with verified dated facts within the period. Each one states its basis and counting criterion, so the figures reconcile across modules. They are the recurring month-to-month reading; the later analysis develops the cases without repeating this summary.

Indicator window: 113 dated facts in August 2026. Facts from earlier months are used only as a comparative framework in the analysis, never as volume for this period.

Executive summary for the month

August 2026 produced 113 verified incidents across the public sector and government agencies in Latin America, led by operational disruptions and a sharp increase in ransomware and extortion compared with July. The month’s strongest signals came from Brazil, Colombia, and Chile, affecting ministries, municipalities, service platforms, and oversight bodies, while Mexico, Paraguay, and Argentina contributed lower-impact outages, attempted breaches, or identity impersonation cases.

The most serious incident in operational terms was the ransomware attack against Colombia’s Ministry of Justice and Law, which degraded digital public services, forced the use of alternative channels, and required technology recovery coordinated with COLCERT, the Attorney General’s Office, Microsoft, and BID partners. The ministry itself confirmed the case as ransomware, isolated systems, and restored services progressively, although the reviewed material showed no public evidence of data leakage. Across the region, the episode again highlighted the operational continuity of citizen service windows and platforms.

In Brazil, the signal combined leaks, alleged data exposures, and attacks claimed or tracked by third parties. There was an investigation into a possible leak of Caged numbers, another front involving alleged leaks of classified data linked to the STF and the Federal Police, an MP-BA investigation into the exposure of personal and health data belonging to more than 290 patients, and a case involving the alleged leak of investigative data inside the Federal Police. At the same time, the municipality of Arcos was linked to ransomware claims by the Emperador group, and multiple municipal bodies in Espírito Santo were taken offline by an attack that exploited Ágape Consultoria infrastructure.

Chile showed a different mix, with a hack of the National Migration Service, an investigation into a medical data leak within Carabineros, an internal disciplinary proceeding and criminal complaint in Curicó over the extraction of intimate material from official phones, and a preventive alert from ANCI after the hack of LiteLLM over a possible credential exposure. There was also a judicial investigation into the alleged leak of case information to a drug trafficking organization inside the judiciary. This was not a single campaign, but several events with different vectors and levels of severity.

The quantitative profile also pointed clearly to the type of risk. With 54 unclassified incidents, 26 ransomware or extortion cases as the primary focus, and only 4 regulatory moves, the month was more operational than regulatory. The absence of critical CVEs mentioned in the analyzed material does not mean there was no exploitation in the region, but it does show that August’s public debate centered on intrusions, outages, internal leaks, and recovery, rather than on specific vulnerabilities identified by name.

Regional overview of the month

The regional reading for August points to high risk, not because of a single campaign, but because of the mix of scale, the range of affected entities, and the functional severity inside agencies that support essential public services. The month brought attacks against ministries, municipalities, judicial bodies, security forces, and government digital platforms, with direct effects on operational continuity, citizen services, and the handling of sensitive information.

Brazil accounted for the largest number of internal compromise cases and leaks. Reports there included ransomware claims against Intranet Gov Brasil and the Prefeitura Municipal de Arcos, attacks on city councils and municipalities in Espírito Santo through a shared provider, and several cases involving the exposure or suspected leakage of personal, health, and investigative data. These incidents do not point to a single pattern, but they do reflect an environment where data access and third-party intermediation increase the risk of spread and lateral exposure.

Colombia produced the highest-profile incident, after the Ministry of Justice confirmed ransomware that affected part of its infrastructure and degraded digital services for citizens. The event came with ColCERT alerts about rising ransomware activity against national targets, along with an institutional response that included containment, system isolation, and phased restoration. From a state continuity perspective, this is the kind of incident that requires a mature recovery plan and a clear prioritization of essential procedures.

Chile, by contrast, showed a more varied attack surface. The National Migration Service suffered an intrusion with a temporary lockout and mass institutional email sending, Curicó faced a leak of intimate material from municipal devices, Carabineros opened an investigation into sensitive medical data, and the Judiciary ended with pretrial detention over a leak of information to a drug trafficking group. Added to that was ANCI's warning about exposed credentials in the LiteLLM supply chain, which pointed to preventive risk and potential exposure, not a confirmed incident with mass impact.

Mexico, Paraguay, and Argentina completed a map dominated by outages, intrusion attempts, and impersonation rather than confirmed large-scale breaches. In Mexico there was a temporary outage of federal government sites and the gob.mx domain, plus the C5i of Tlaxcala case involving an attempt to compromise information. In Paraguay there were allegations of DDoS attacks against public agencies. In Argentina, the standout cases were the scam that impersonated the BCRA and the attack on Oldelval, which preserved operational continuity. The result is a high regional risk profile, with very concrete operational and leakage hotspots.

Period indicators

Relevant Incidents

Colombia, Ministry of Justice and Law

The month’s most sensitive case was the ransomware attack against Colombia’s Ministry of Justice and Law, confirmed by the agency itself starting on August 2 and accompanied by visible operational impacts for several days. The entity reported temporary system unavailability, disruption to part of its technology infrastructure, and the activation of alternate channels for citizen service while containment and recovery efforts moved forward.

The sequence matters because it separates perception from evidence. The Ministry confirmed that COLCERT found preliminary indicators consistent with ransomware, and later said some public digital services were degraded. It also reported joint work with the Attorney General’s Office, COLCERT, Microsoft, and BID partners, which points to a coordinated technical and institutional response. No public evidence appears in the material of data theft from those systems, so the verifiable damage was primarily to availability.

The operational reading is clear. When a justice ministry loses partial availability, even without a confirmed public leak, the impact turns into delays in procedures, backlogs in case files, and greater pressure on in-person channels. The speed of isolation and recovery mattered, but the episode exposes a recurring issue in the region, dependence on single platforms to manage PQRDSF, case files, and query services.

Direct source from the ministry itself, dated August 2, 3, 8, 15, and 20, 2026, with support from external technical coverage in Infobae Colombia, DarkReading, DataEnforce, White Hunters, eSoft, and Nexsight.

Oldelval and Argentina’s energy front

Oleoductos del Valle reported to the CNV that it suffered a cyberattack on its administrative systems, but said crude transport continued without interruption. At the same time, specialized media described the incident as RaaS ransomware, and an actor attributed to Incransom said it had exfiltrated internal documents, including human resources, financial, and regulatory material.

The key point is the separation between operational impact and potential confidentiality impact. The company spoke of affected administrative systems, not a shutdown of the pipeline. The later claim in intelligence sources suggests exfiltration, but the material makes clear that the full scope was not independently confirmed and that there was no public validation of how many people were affected. In this case, the business risk is closer to document exposure than to the loss of physical continuity.

The combination of critical operations and administrative exposure is especially sensitive in energy infrastructure. This was not just a corporate incident, because the regulatory environment and market confidence are also in play. The case also showed how ransomware groups mix public pressure, victim listings on leak sites, and claims about data volume to maximize the visibility of the incident.

Espírito Santo and Ágape Consultoria’s supply chain

The facts around Ágape Consultoria point to a campaign with cascading municipal consequences. Local coverage said that websites and databases belonging to several municipalities and city councils in Espírito Santo went offline or were compromised after an attack that exploited vulnerabilities in the provider’s central servers. In parallel, analysis by PacificSec expanded the potential universe of affected clients.

The significance of the case is not only the number of public bodies reached, but the dependency pattern. If a provider serves dozens of city councils and municipalities, a central compromise can become a broad failure. The evidence collected in the material indicates that João Neiva, Ibatiba, Brejetuba, and Vitória were among the entities mentioned, along with other municipal institutions in the state.

There is no fully closed classification of the final impact here, because the sources mix access to databases, website outages, ransomware claims, and IT contingency needs. But the strategic message is consistent. The public sector attack surface does not end with each municipality’s own infrastructure, it extends to integrators, consultancies, and software vendors with privileged access.

Intranet Gov Brasil and The Gentlemen’s claim

Intranet Gov Brasil appeared in several tracking sources as a victim claimed by the group The Gentlemen. Breachsense logged it as a breach, Intel and Breaches included it among 83 new ransomware victims, and other monitoring platforms flagged the case as a leak-site post or an unconfirmed claim. The material, however, provides no public validation from Brazilian authorities or from the platform operators at the time of reporting.

For that reason, the case should be treated cautiously. The domain name and its description as a digital portal for public services and online access for citizens and companies suggest a wider infrastructure than a simple internal intranet. But the available material does not allow a determination of whether there was encryption, only a leak-site mention or exfiltration. That uncertainty does not erase the event, but it does mean it should not be overstated.

From a monitoring perspective, this kind of claim is useful as an early warning of reputational exposure and possible investigative follow-up. If the victim belongs to Brazil’s federal ecosystem, any reference to credentials, internal access, or shared services should be checked urgently. This month’s situation reinforces that ransomware victim lists are an early signal, not a closed proof of impact.

Chile’s National Migration Service

Chile’s National Migration Service suffered a hack on August 18 that temporarily blocked its platform and led to mass emails sent from institutional accounts with images and messages unrelated to the agency’s usual work. Sources agree that the site was unusable for several hours, roughly between 5 a.m. and 9 a.m., and that service was restored later that same day.

This incident is different from classic ransomware. The material does not describe encryption or financial extortion, but rather platform blocking, misuse of institutional accounts, and an action with a strong sabotage or defacement component. Coverage also notes that, so far, it has not been reported whether personal data or sensitive records were compromised, so the impact on stored information remains unconfirmed publicly.

The operational reading is uncomfortable for public administration. Even though restoration was quick, citizens could not complete online procedures for several hours. The case also showed that the integrity of institutional email channels is part of public trust, not just technical continuity. A restored portal with compromised accounts remains a sensitive attack surface.

Curicó and the leak from institutional devices

Curicó’s municipality opened an internal disciplinary process and referred the matter to prosecutors after the leak and viral spread of intimate videos extracted from institutional phones. Sources describe a modus operandi in which a municipal IT employee allegedly accessed private photos and videos while repairing municipal or personal phones, raising the case from an administrative violation to a possible criminal matter.

Here the focus is not ransomware or an external intrusion, but abuse of legitimate access and irregular extraction of sensitive content. That detail matters, because in the public sector the boundary between technical support and improper access can be thin when there is no strong separation of duties, no activity logging, and no controls over managed devices. The municipality responded by removing the employees involved while the investigation continued.

The case also left a deep reputational risk. When a leak involves intimate material, the harm to those affected is immediate and the institutional exposure goes beyond classic cybersecurity. The criminal investigation and internal disciplinary process show that the problem was technological, disciplinary, and about internal trust.

Argentina, the BCRA, and impersonation fraud

The Central Bank of the Argentine Republic issued a public warning about a virtual scam that impersonates its identity and that of its officials. According to the notice, attackers used manipulated videos and channels such as email, WhatsApp, or SMS to simulate official communications and obtain data or payments. The BCRA clarified that it does not request payments or banking information through those means.

This is fraud and phishing, not a break-in against the bank’s internal systems. The value of the alert is that it shows a sufficiently convincing institutional impersonation to require direct public communication. The notice also includes a response path, if someone installed an app or shared data, they should contact their bank immediately and file a report with UFECI.

At the same time, the Oldelval case in Argentina increased attention on energy infrastructure and regulated services. There is no causal link between the BCRA scam and the Oldelval attack, but both incidents show that in Argentina’s public and para-public sector, social engineering threats coexist with more technically complex attacks. That coexistence means no single risk class should be prioritized to the exclusion of the others.

Mexico, Tlaxcala, and the collapse of government portals

Mexico produced several availability incidents. The federal government and the gob.mx domain experienced temporary outages and connectivity cuts, while Tlaxcala’s C5i registered a hack with an attempted breach of information. The material describes the episode as site disruption and widespread outage, but not as a breach with confirmed data theft.

The importance of the Mexican block is that the connectivity failure was not treated by the media only as a technical problem, but as an indicator of deeper vulnerability in public digital infrastructure. That does not amount to a confirmed exfiltration incident, but it does show dependence on links, configuration, and operational resilience. The Tlaxcala case adds the variable of an attempted access to public safety information.

In both episodes, the correct reading is that public visibility of the outage is itself a trust problem. When government portals go offline or become unstable, citizens perceive fragility even if the cause is not a data compromise. For public teams, those minutes of unavailability often open pressure windows for support, the media, and political authorities.

Chile, the judiciary, and sensitive leaks

On August 28, a Chilean judiciary employee was placed in pretrial detention after being accused of leaking information from judicial investigations to a drug trafficking organization. Sources refer to case files, rulings, and precautionary measures shared without authorization, with the Public Ministry involved and a decision from the San Bernardo Guarantee Court.

This is not a technical attack, but it is institutional cybersecurity in the strict sense, because it shows abuse of access to protected information inside the state. Unlike malware or a ransomware campaign, the problem here lies in malicious use of privilege. That kind of incident is harder to detect with traditional perimeter tools and usually depends on traceability, query controls, and internal auditing.

In the same month, Carabineros opened a disciplinary inquiry over the leak of sensitive medical data, which reinforces the pattern. There is a common signal, exposure of restricted information inside agencies that handle large volumes of personal and judicial data. The response needs to go beyond the specific incident and review access profiles, segregation of duties, and alerts for abnormal behavior.