- Chile has promoted a pioneering legal framework in cybersecurity, with Law 21.663, Law 21.459 and the National Cybersecurity Policy.
- Cyberattacks in the region are less numerous but more targeted and sophisticated, with ransomware and phishing playing a particularly prominent role.
- The National Cybersecurity Agency and the CSIRTs are structuring a new institutional model with a risk-based approach and aligned with international standards.
- Businesses, the government, and citizens share the responsibility to strengthen the culture of digital security through technology, processes, and continuous training.
Cybersecurity in Chile has quickly gone from being almost exclusively the domain of technicians and IT professionals to becoming a daily concern for businesses, public administrations, and citizens. The country has suffered high-impact incidents and, at the same time, has promoted a pioneering legal framework in the region that is completely changing how digital security is understood.
In recent years, the rapid pace of digital transformation , the adoption of cloud services, and the rise of remote work have expanded the attack surface available to cybercriminals. Although overall intrusion attempts in Latin America appear to have slowed, attacks are now much more targeted, profitable for attackers, and capable of paralyzing essential services if defenses are inadequate.
Overview of cybersecurity in Chile and Latin America
Across the region, the digital ecosystem has grown exponentially : new online services, digitization of traditional products, massive deployment of connected devices, and accelerated adoption of innovative technologies. All of this makes the Latin American digital environment particularly attractive to cybercrime.
According to Fortinet data, more than 360 billion cyberattack attempts were recorded in Latin America and the Caribbean in 2022, while in 2023 that figure dropped to around 200 billion. Even with this quantitative decrease, the countries with the highest offensive activity remained at the top of the list: Mexico, Brazil, and Colombia accounted for a large portion of the detected incidents.
This apparent improvement is deceptive: reports indicate that while the total number of attempts decreases, accuracy increases . Attackers are no longer shooting at everything that moves, but are focusing their resources on specific targets, with more sophisticated and better-prepared campaigns, seeking to maximize the return on each intrusion.
Ransomware continues to occupy a prominent position in the threat landscape . Far from being a thing of the past, these data kidnapping campaigns have become more sophisticated, combining classic techniques with social engineering, silent lateral movement, and prior leaks of information with economic or strategic value.
The direct consequence of all this is that organizations with fragmented, manual, or outdated defenses are especially vulnerable. Without integrated, automated, and up-to-date cybersecurity solutions, the likelihood of experiencing a serious incident increases dramatically, particularly in sectors with essential services or critical infrastructure.
The situation of Chilean companies in the face of cyberattacks
In the specific case of Chile, several studies indicate that a significant percentage of the productive sector has already suffered incidents. Four out of ten companies have reportedly been victims of some type of attack in recent years, and in approximately 90% of cases, the primary vector has been phishing.
The country ranks among the most vulnerable in Latin America to email and messaging scams , reaching approximately four thousand such attacks per month in 2022. Much more than an isolated problem, this reflects a dangerous combination of high levels of digitalization and low awareness among part of the population and the business sector.
The incidents suffered by Chilean public institutions have highlighted the fragility of certain systems. High-profile cases such as the hacking of the Joint Chiefs of Staff, which exposed sensitive information related to national security, or the attack on SERNAC (the National Consumer Service), which rendered its systems inoperable for almost two weeks, demonstrate that neither the public nor the private sector is safe.
The judiciary also experienced security incidents with operational impact, underscoring that cybersecurity is not just a matter of servers or networks, but of institutional continuity and public trust. Episodes of this kind affect the public's perception of the State's resilience against digital threats.
One of the major underlying problems is the widespread lack of awareness regarding data protection and digital best practices . Many individuals and small businesses still view cybersecurity as something distant, almost theoretical, rather than a fundamental aspect of their daily operations. This delays the adoption of preventative measures and leaves the door open to relatively simple attacks.
Meanwhile, various global reports, such as those from IBM, estimate that the average cost of a data breach exceeded $4 million in 2022, reaching record highs. This economic impact—which includes service disruptions, reputational damage, penalties, and recovery—demonstrates that the attackers' business is profitable and that organizations, without exception, are in the crosshairs.
Main types of cyberattacks affecting Chile and the region
Latin America has climbed the ranks in global incident indicators, now occupying a prominent place among the most attacked regions in the world. According to threat intelligence reports such as the X-Force Threat Intelligence Index, ransomware accounts for around a third of incidents , but it coexists with many other vectors that also hit hard in Chile.
Ransomware involves infecting systems to encrypt data, disable equipment, or block critical processes. In exchange for the supposed restoration, criminals demand payment—usually in cryptocurrency — and often threaten to publish the stolen information. Global cases like WannaCry demonstrated the extent to which such an attack can paralyze both private companies and public organizations in a matter of hours.
Phishing and other social engineering techniques have become the preferred entry point for many attackers. Emails, SMS messages, or social media posts impersonating banks, courier services, government agencies, or even direct supervisors trick users into providing credentials, credit card information, or downloading malicious files, all while believing they are receiving legitimate communication.
The term malware encompasses viruses, Trojans, spyware, adware, botnets, and other code designed to compromise devices and networks. They often disguise themselves as legitimate programs, attachments, or seemingly harmless updates. Once installed, they allow remote control of the computer, data theft, or the addition of zombie devices to networks.
Distributed denial-of-service (DDoS) attacks aim to take down websites, e-commerce platforms, or online services by overwhelming their response capacity. Their impact on organizations can range from lost sales to significant damage to their public image, especially when they affect citizen or customer service departments.
At the most stealthy level are advanced persistent threats (APTs) , sophisticated attacks in which one or more intruders infiltrate a network and remain hidden for as long as possible. During this period, they observe, exfiltrate strategic information, and prepare subsequent moves, all while minimizing any signals that could alert defense systems.
Another relevant vector is man-in-the-middle attacks , in which the attacker positions themselves between two ends of a communication—for example, between a user and a website—intercepting and manipulating the traffic. With this technique, they can spy on sensitive data or impersonate one of the parties.
Finally, the role of internal threats cannot be overlooked . Disgruntled employees, contractors with excessive access, human error when handling paper-based information or unsecured devices—all of these can trigger incidents as serious as those originating from outside, and are often more difficult to detect in time.
Regulatory and institutional framework of cybersecurity in Chile
While the European Union has been developing a robust legal framework for digital security for years, regulatory development in Latin America has been more uneven . Some bills in the region have drawn criticism for the risk of affecting fundamental rights by creating excessive control structures under the guise of cybersecurity.
Chile, however, has opted for a more balanced approach and has positioned itself at the forefront regionally with the enactment of Law 21.663 on Cybersecurity and Critical Information Infrastructure . This law, enacted on March 26, 2024, and published in the Official Gazette on April 8, is considered the first comprehensive framework in the region specifically designed to address the escalating cyberattacks.
The law is accompanied by the National Cybersecurity Policy 2023-2028 , which sets out the country's main lines of action in this area. Both instruments function as complementary pillars: the law establishes obligations, powers, and sanctions, while the policy articulates strategic objectives, inter-institutional cooperation, and medium- and long-term actions.
It is worth remembering that Chile already had Law 21.459 on Computer Crimes , approved in 2022, which updated the penal code, adapting it to the standards of the Budapest Convention. This law introduced new types of offenses, such as unauthorized access to systems or interference with data, and strengthened the range of sanctions applicable to cybercriminals.
In parallel, a draft of a new personal data protection law is being discussed , aimed at modernizing the current framework and aligning it with standards such as the European General Data Protection Regulation (GDPR). This initiative will require organizations to implement more stringent technical and organizational measures to guarantee the privacy and security of the information they process.
In addition to specific laws and policies, Chile has a National Cybersecurity Policy that emphasizes the need for public-private cooperation, human capacity building, and strengthening of critical infrastructure. The goal is to establish a national approach in which digital security ceases to be a silent issue and becomes a shared objective.
Chilean Law 21.663: content, principles and new institutional model
With the implementation of Law 21.663, Chile has positioned itself as a pioneering country in the region with a comprehensive cybersecurity framework . This goes beyond simply defining crimes or listing penalties; it involves creating an institutional architecture capable of preventing, coordinating, and responding efficiently to incidents that affect essential services.
One of the central elements of the law is the creation of the National Cybersecurity Agency (ANCI) , a specialized body with clearly defined regulatory, supervisory, and enforcement functions. This agency will be responsible for ensuring compliance with cybersecurity requirements applicable to both the public sector and private entities that provide essential services.
Along with the ANCI, the law strengthens the role of the Computer Security Incident Response Team (CSIRT) , both at the national and defense levels. These teams will act as a central point in incident management, channeling mandatory notifications of cyberattacks and coordinating the necessary technical response to contain, eradicate, and recover affected systems.
The management of the ANCI and the CSIRTs will be in the hands of civilian officials appointed through the Senior Public Management System , ensuring a professional profile and preventing cybersecurity from being confined exclusively to the military or police spheres. However, close collaboration with law enforcement agencies is planned for tasks that require it.
A key aspect is that all entities providing essential services —whether public or private—must adopt robust prevention, detection, and response measures. Their obligations include promptly reporting any relevant incident to the national CSIRT, which is essential for activating an early response and minimizing damage.
During the parliamentary process, the bill benefited from input from industry, academia, and specialized organizations . This participatory approach allowed for refining the text, incorporating international experiences, and strengthening the holistic vision, something essential in a field as cross-cutting as cybersecurity.
Guiding principles and alignment with international standards
Chilean regulations are built upon a series of guiding principles that seek to balance effective protection, respect for rights, and operational viability for the private sector. The aim is not to create bureaucratic obstacles, but rather to establish clear rules for all stakeholders.
First, the law adopts a risk-based approach , taking into account the recommendations of organizations such as the International Telecommunication Union (ITU) and the National Institute of Standards and Technology (NIST). This translates into obligations that are graduated according to the criticality and exposure of each entity, avoiding burdening companies with requirements disproportionate to their size or activity.
The definition of cybersecurity is anchored in information security, in accordance with the standards of the International Organization for Standardization (ISO). Confidentiality, integrity, and availability remain the three pillars upon which the technical and organizational requirements are built.
ANCI itself must act in accordance with the principle of rationality : the measures it adopts must be necessary and proportionate to the level of risk and the potential social and economic impact. In addition to monitoring and imposing sanctions, the agency will have the authority to promote public awareness campaigns, reinforcing the educational component.
Another key principle is security and privacy by default and by design . Computer systems, applications, and technological solutions must be designed from the outset with built-in safeguards, so that the protection of personal data is not an afterthought, but a structural requirement.
The law also stipulates that violations will be sanctioned according to the procedures of the corresponding sectoral legislation, coordinating the actions of the ANCI with the authorities in each area (telecommunications, finance, etc.). This avoids duplication and overlap in oversight, especially in the ICT sector, where extensive specific regulations already exist.
Finally, a cooperation framework for incident resolution is established , in which entities must collaborate with the competent authority and implement containment and damage control measures. The idea is that no one can turn a blind eye when an attack occurs that compromises the provision of essential services.
The role of the State, the private sector, and citizens in cybersecurity
Improving cybersecurity cannot be delegated solely to a ministry or specialized agency. It must be part of governments' strategic agendas , on par with economic stability or physical security, because today the digital dimension permeates virtually every aspect of life.
States are called upon to design national strategies consistent with international best practices , promote the training of highly qualified professionals, and provide stable resources to specialized agencies. It is also vital to foster cooperation between countries to combat transnational crime and share information on emerging threats.
However, even a highly advanced state cannot guarantee complete protection on its own. Responsibility is shared among all actors in cyberspace : large corporations, SMEs, service providers, educational institutions, and every individual internet user. A weak link in the chain can create an exploitable vulnerability to compromise far more critical systems.
In the business world, cybersecurity is no longer a reactive expense but a strategic investment . Protecting the information of customers, employees, and partners, preventing service interruptions, and ensuring regulatory compliance are factors that directly impact competitiveness and market confidence.
Public-private collaboration is presented as one of the greatest opportunities for improvement . Sharing engagement indicators, best practices, tools, and lessons learned allows for raising the average level of protection and responding more quickly to large-scale campaigns or incidents affecting critical infrastructure.
Strategies and best practices for companies in Chile
Beyond simply complying with the law, Chilean organizations need to integrate cybersecurity into their daily operations . It's not enough to install antivirus software and forget about it: a strategy combining technology, processes, and people is essential.
A crucial first step is to conduct regular risk assessments . Understanding which assets are most critical, which systems are most vulnerable, and what the potential entry points for an attacker are helps prioritize investments and focus efforts on what can truly disrupt operations.
On the technological front, deploying advanced protection solutions is essential : next-generation firewalls, intrusion detection and prevention systems, continuous monitoring, antimalware solutions, and vulnerability management tools. Each organization will need to tailor the suite of solutions to its size and sector, but the common goal is to have visibility and the ability to react quickly.
Staff training is a critical factor. Employees are the first line of defense, but also the main entry point if they are not properly trained. Training programs on detecting fraudulent emails, secure password management, mobile device protection, and handling sensitive information can make all the difference.
It is equally important to have a clear and proven incident response plan . Knowing who does what, who is notified, which systems are isolated, and how to communicate with customers, suppliers, and authorities reduces chaos when an attack occurs and helps the organization return to normal as quickly as possible.
Cybersecurity is dynamic: threats are constantly evolving . Therefore, reviewing and updating policies, procedures, and technologies should be an ongoing process, not something done only once every few years. Internal audits, compliance reviews, and simulated attacks help keep the system up-to-date.
Simple measures such as keeping software up to date , avoiding the use of unsupported systems, regularly changing passwords, protecting company mobile devices, and making frequent backups remain essential. Although they may seem basic, many serious breaches originate precisely from the lack of these minimum requirements.
Another aspect not to overlook is the use of secure Wi-Fi networks . Working with sensitive information over open public connections increases the risk of data interception. Whenever possible, it's advisable to use private networks or solutions like corporate VPNs to encrypt communications.
Finally, ongoing team training is the final piece of the puzzle. Regular reminders, phishing simulations, refresher sessions, and open channels for reporting incidents or questions help build a shared security culture , where everyone understands their role in protecting the organization.
Cybersecurity in Chile is at a pivotal juncture: on the one hand, the country has made progress toward a leading regulatory and institutional framework in the region; on the other, businesses and citizens continue to face an increasingly sophisticated threat environment. Integrating digital security as a natural part of management, fostering collaboration across sectors, and strengthening training at all levels are emerging as the most effective path to protecting rights, essential services, and economic stability in an increasingly connected world.
