Guatemala Health Ministry Says National Lab Attack Was Contained, No Sensitive Data Exposure Found

Summary

Guatemala’s health ministry says ransomware encrypted internal National Lab files, later restored, with no evidence sensitive data was accessed. Separately, the Army reported a Digecam website intrusion; claims of stolen data remain disputed.

Key points

• The National Laboratory attack began March 9 and was contained the following day; internal files, described as institutional forms, were encrypted and later restored from backups.
• The laboratory director said ransomware or a trojan entered through the web portal. The origin remains unknown; reported Russia and Malaysia locations may have been masked using a VPN.
• The health ministry said its technical assessment found no evidence of unauthorized access or compromise of sensitive patient, user, or entity data.
• The ministry reported strengthening security controls, including system updates and access reviews; the web platform was still under review, and a complaint was filed with prosecutors.
• A separate Digecam website intrusion on April 7 reportedly lasted about 13 hours and followed attackers obtaining user credentials. The Army disputed claims of massive data theft, while the article reports data was offered for sale online and experts warned of risks.
• The article also notes that a proposed cybersecurity law, which passed a second reading in September 2025, had returned to the congressional agenda.

MITRE ATT&CK

People