The Institute of Public Health of Chile (ISP) issued this public notice informing that all digital service channels, registration systems, and online consultations were non-operational due to a cybersecurity contingency.

The measure was described as a preventive action, and users were told services would not be available through those digital platforms until further notice.

"We will keep you informed," the ISP stated.

On Friday, June 27, 2025, Chile’s Instituto de Salud Pública (ISP) , the national body responsible for drug control, lab diagnostics, and import certifications was hit by a severe cyberattack. As a result, the ISP disabled all digital service platforms, including its website, public-facing registration systems, and interoperability with other government agencies. The institute issued public advisories confirming a shutdown of services as a preventive cybersecurity measure.

Operational Disruption

According to a report by BioBioChile, the attack had the following consequences:

• Customs and health imports were disrupted, particularly certificates required to process pharmaceutical shipments.
• The SIAC (Integrated Citizen Service System), the institute’s digital communication channel, remained offline for days.
• Manual workarounds were used to handle only urgent cases.

The ISP has not confirmed a data breach, but there is rising concern over possible data exfiltration especially sensitive health and pharmaceutical information.

Signs Pointing to Ransomware

While no official classification has been provided by the ISP or Chilean government, the pattern of the attack suggests ransomware:

• Complete digital service disruption (more than 6 days).
• Gradual restoration efforts without confirmation of recovery from backups.
• External reports hint at potential data theft and ransom demands.

Security researchers and news sources have identified Qilin as a likely suspect.

Who Might Be Behind the Attack?

Qilin (also known as Agenda) is a Ransomware-as-a-Service (RaaS) group active since 2022. It provides malware kits to affiliate hackers who carry out attacks. Known traits include:

• Double extortion tactics: encrypting files and threatening to leak stolen data.
• Targeting of healthcare and Spanish-speaking regions, including recent attacks in Spain (e.g. on Asefa Insurance, where 210 GB of data was leaked).
• Use of known vulnerabilities (e.g., Fortinet firewall exploits) to gain access.

Recovery Timeline & Latest Update

As of July 1, 2025, ISP systems remain partially down, with recovery still underway.

The National Cybersecurity Agency (ANCI) is actively coordinating with ISP.

Investigations are ongoing. No formal attribution has been made, but Qilin remains the primary suspect.

On July 9, the Institute of Public Health of Chile (ISP) issued a new advisory confirming the partial restoration of services affected by the June 27 cyberattack. The institute announced that access to certain benefits through the SAFIS system had been reestablished. Companies must now be registered in this system to access services, and user support materials have been made available. ISP also reported that data related to ongoing procedures is currently in the recovery phase, with further updates to follow as operations continue to normalize.

Lessons for Cyber Resilience

This incident at the ISP is a strong reminder that any organization no matter its role or purpose can become a target of cyberattacks. It also teaches some clear lessons for both technical and non-technical teams that want to improve their protection against such threats :

Digital Dependency Must Be Matched with Digital Defense

The ISP’s six-day paralysis demonstrates the risks of overreliance on interconnected systems without robust contingency planning. Core services like health certifications and regulatory approvals came to a halt. This tells us:

• Business continuity plans must include tested fallback options, including offline workflows for mission-critical processes.
• Cloud and on-premise systems alike must be regularly audited for vulnerabilities and backup integrity.

Ransomware Is Not Random – It Is Strategic

The suspected involvement of Qilin highlights that attackers often target sectors with high-stakes data and limited recovery flexibility like healthcare, government, and infrastructure. Lessons here:

• Attackers do research. Institutions must do threat modeling, assessing why they might be a target and securing the systems most likely to be exploited.
• Data isn’t just a technical asset , it’s leverage in extortion. Organizations must treat sensitive data as a liability as much as an asset and secure it accordingly.

Training & Culture Matter

Ransomware often enters through phishing emails or misused credentials. This reinforces that:

• Every user is a potential entry point. A culture of cybersecurity awareness—not fear—is essential.
• Training must go beyond compliance and include scenarios, simulations, and practical action steps.

Closing Thoughts

The cyberattack on Chile’s Public Health Institute shows that online threats can happen to anyone, anytime ,even important public institutions. Today, health systems and government services are big targets for hackers. That’s why being prepared is not just important , it’s necessary. Simple things like using strong passwords, regular backups, and having a plan in case of an attack can make a big difference. We should not wait for an attack to act ,we need to be ready in advance.