Secretaría de Modernización Data Breach

qilin listed Secretaría de Modernización, the Argentine government secretariat responsible for digital government initiatives and administrative modernization, on its leak site on 2026-10-10. qilin claimed 214 victims in the past 60 days across every major sector. Government targets represent a minority of its victim set but carry higher extortion leverage given public-facing service obligations and political sensitivity. The broader context of qilin’s activity shows consistent targeting across various sectors over the last 60 days, with 214 claimed victims. While government entities are not the most frequent targets, they represent a segment where the impact of ransomware can be amplified due to critical public services and the political implications of data breaches. This indicates a potential pattern of exploiting vulnerabilities in critical infrastructure, regardless of sector.

The stealer-log verdict for Secretaría de Modernización indicates a “notable_exposure_in_sample.” Specifically, no employee workstation credentials (Category A) were found within the sample, but 25 external user accounts (Category B) were recovered. This exposure is linked to auth.riogrande.gob.ar, which serves as the identity provider for Argentina’s Tierra del Fuego provincial government. These recovered credentials likely belong to citizens or third-party users accessing Argentine government digital services, rather than direct employees of Secretaría de Modernización. While this sample does not confirm an infection on organizational workstations, the presence of active infostealer campaigns targeting Argentine government authentication infrastructure is confirmed. The combination of a qilin listing and observed stealer activity targeting government identity provider endpoints presents a significant, compound threat signal that necessitates a response. The most prudent response involves addressing both indicators: the ransomware listing and the activity observed in the portal’s credential data. This includes auditing all administrative accounts for unauthorized access, enforcing multi-factor authentication across all government portals, and conducting a thorough session audit on auth.riogrande.gob.ar. Coordination with CERT Argentina is also recommended. The data retrieved from stealer logs may not encompass the full extent of qilin’s potential access, highlighting the need for further investigation into Secretaría-owned domains.

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.