Ransomware Strikes Colombian Justice Ministry Ahead of Presidential Transition

Colombian Justice Ministry building with digital padlock and IT responders

Colombia’s Ministry of Justice was hit by a ransomware attack on August 2, affecting parts of its IT infrastructure and degrading several public-facing services just days before a national presidential handover. The disruption touched systems used for illicit-drug monitoring and legal processes; while some files were encrypted, the acting minister at the time, Cielo Rusinque, said publicly that there was no evidence of data exfiltration. The incident arrived amid heightened warnings from the country’s national CERT and against a backdrop of escalating cyber activity across Latin America.

A targeted strike at a fragile moment

The timing of the attack—five days before the presidential transition—amplified political and operational consequences. ColCERT had issued threat intelligence shortly before the incident, warning that ransomware groups were intensifying their focus on Colombian targets. Government transitions naturally create windows of organizational change and distraction, and adversaries often probe such moments for opportunities. Even when operational disruption is limited to encrypted files and interrupted services, the optics and potential secondary impacts (delays in legal processes, interrupted monitoring) can be significant.

What happened and what authorities said

According to official statements, attackers encrypted some files, and recovery efforts were underway. Acting Minister Cielo Rusinque publicly denied that information had been stolen, emphasizing that there was no confirmed data capture. Still, those denials contrast with media reports suggesting leaked data—illustrating how uncertainty and competing narratives often follow breaches. For organizations and citizens alike, the immediate concerns are service availability, integrity of legal records, and assurance that personal or sensitive data have not been exposed.

A pattern of growing pressure on Colombian institutions

This incident is part of a broader surge in cyberattacks across Colombia and the wider Latin American region. Earlier in the year, the national tax authority (DIAN) was targeted by an alleged intruder using the handle ArcRaidersPlayer. In July, Ecopetrol, Colombia’s largest oil-and-gas company, disclosed a breach that affected IT networks across numerous subsidiaries and likely exposed information for thousands of users. These cases underscore that both state agencies and major enterprises are attractive and viable targets for criminal and state-sponsored actors.

The evolving threat landscape in Latin America

Security telemetry and industry reporting point to a maturing, automated threat ecosystem in Latin America. Experts note that while some reconnaissance activity dipped in recent periods, exploit attempts rose—along with specific exploit classes such as Log4j abuses and increased malware detections. Automation enables attackers to scan vast ranges of infrastructure for vulnerable services, attempt exploitations at scale, and then deploy malware or monetize access through ransomware and extortion.

Cloud posture and third-party relationships as critical vulnerabilities

Many Colombian public and private organizations have expanded cloud footprints faster than they’ve built cloud security controls. Misconfigured cloud storage and exposed services have been privileged entry points in recent incidents. Security leaders warn that weaknesses in cloud posture management amplify risk, especially when coupled with risky third-party relationships. Managed service providers, vendors, and partner ecosystems can create systemic vulnerabilities: an attacker who compromises one supplier may gain lateral paths into multiple client environments.

Practical lessons and defensive priorities

Several defensive priorities emerge from the pattern of incidents:

Harden the attack surface: prioritize patching for commonly abused protocols (SMB, exposed web services) and reduce unnecessary public exposure.
Improve cloud hygiene: enforce least privilege, inventory and monitor cloud storage, and adopt cloud posture management tooling to detect misconfigurations.
Strengthen third-party risk management: require stronger security baselines for vendors and regularly test supplier controls and segmentation between partner and core systems.
Prepare for transitions: maintain incident response continuity plans across political or organizational transitions so handovers don’t create detection or response gaps.
Automate detection and response: employ telemetry-driven tooling and automation to detect and contain rapid, large-scale exploitation attempts.

Looking ahead

Colombia’s recent incidents reflect a larger regional trajectory: adversary capabilities are scaling through automation even as defensive maturity lags. The combination of political transitions, accelerating cloud adoption, and complex supply chains creates fertile ground for further disruptive campaigns. For public-sector organizations and critical infrastructure operators, the imperative is clear—invest in fundamentals, tighten external dependencies, and build resilient response plans that remain effective during periods of organizational change. Doing so will reduce the operational impact of future incidents and blunt the strategic advantage attackers often seek through timing and disruption.