Peru denies federal system ransomware attack but confirms attack on regional capital

The Peruvian government has officially denied claims that its federal digital platform was compromised in a ransomware attack, despite assertions made by the Rhysida ransomware gang. 

The Ministry of Government and Digital Transformation issued a statement on Thursday addressing Rhysida's claims of taking over the government's domain. The ransomware group had demanded a 5 bitcoin ransom (approximately $472,000) and shared documents allegedly stolen from Peru's government portal (gob.pe).

While federal authorities denied any compromise of the main government website and claim that services continue operating normally, they did acknowledge that hackers gained access to the tax administration website of the regional capital Piura.

The Tax Administration Service in Piura subsequently released its own statement confirming a cyberattack. According to Piura officials, the incident impacted operations, but service was restored within 48 hours. The regional IT team reported the incident to Piura's provincial prosecutor's office and denied that any data was stolen during the attack.

Peru's National Digital Security Department (CNSD) has activated their incident management teams, and federal authorities launched an investigation. The government has also urged state-level entities to report all cyber incidents to the National Centre for Digital Security and cautioned Peruvians to rely only on information from official government sources.