Hacktivist Attacks on Critical Infrastructure in Latin America: A Rising Threat

Executive Summary

Hacktivist groups are increasingly targeting critical infrastructure in Latin America, posing significant risks to sectors such as energy, healthcare, and finance. Notably, the international group Guacamaya has conducted operations against government entities in countries like Chile, Colombia, and Peru. Additionally, the 2025 Paraguay ransomware attack exemplifies the growing threat to governmental and public sector organizations.

Introduction

In recent years, Latin America has witnessed a surge in cyberattacks targeting critical infrastructure, with hacktivist groups at the forefront of these operations. These groups, driven by ideological motives, have expanded their activities beyond traditional targets to include essential services, thereby amplifying the potential impact of their attacks.

Guacamaya: A Case Study in Hacktivist Operations

Guacamaya, an international hacktivist group, has been active in Latin America, targeting government entities in countries such as Chile, Colombia, El Salvador, Guatemala, Mexico, and Peru. Their operations often involve publishing sensitive information to the public, aiming to expose perceived injustices and promote transparency. For instance, in 2022, Guacamaya claimed responsibility for hacking into the Chilean Army's servers, releasing confidential documents to highlight alleged human rights abuses.

The 2025 Paraguay Ransomware Attack

In June 2025, Paraguay experienced a significant ransomware attack attributed to the group Brigada Cyber PC. The attackers encrypted files across several government agencies and demanded a ransom of approximately $7.4 million. Despite the government's denial of the attack's authenticity, data was leaked online, including information from the National Traffic Agency and various ministries. This incident underscores the vulnerability of governmental systems in the region to cyber threats.

Impact on Critical Sectors

The healthcare sector has also been a prime target. In September 2025, Brazil's healthcare software provider MedicSolution was hit by the ransomware group KillSec, exposing sensitive patient data across hospitals and clinics. This breach not only compromised patient confidentiality but also disrupted healthcare services, highlighting the critical need for robust cybersecurity measures in the sector. (privatebank.jpmorgan.com)

The financial sector is similarly at risk. In 2024, the Central Bank of Brazil uncovered a breach in the PIX instant payment system, where insiders and hackers stole approximately $100 million USD. This incident prompted immediate measures to enhance the security of the financial system, emphasizing the need for continuous vigilance against cyber threats. (privatebank.jpmorgan.com)

Conclusion

The increasing frequency and sophistication of hacktivist attacks on critical infrastructure in Latin America present significant challenges. These incidents highlight the necessity for enhanced cybersecurity strategies, international collaboration, and a proactive approach to safeguarding essential services from cyber threats.

Highlights:

• Latin America Leads Cyberattacks: 3,065 Weekly Hits 2025, Published on Wednesday, March 11
• Cyber Attacks Surge in Latin America | Dec 2025, Published on Monday, January 12
• The cybersecurity imperative: Latin America’s challenge and opportunity | J.P. Morgan Private Bank Latin America, Published on Monday, March 09