Chile's essential service providers and operators of vital importance reported 566 cybersecurity incidents with significant effects to the National Cybersecurity Agency (ANCI) between January 1 and October 15, 2026, 166% more than the 213 of all of 2025, according to an agency letter dated October 23 obtained by the investigative unit of BioBioChile. The document was provided in response to a transparency request and was published on Saturday, November 7.
The comparison comes with a caveat: mandatory reporting began on March 1, 2025, so that year's total covers only ten months. Even so, the monthly average went from about 21 reports in 2025 to around 60 in 2026, a 180% rise. Between July and mid-October more than 240 reports came in, about 70 a month. This article gathers the figures on cyberattacks in Chile, which sectors are rising, what explains the increase and what the law requires.
Cyberattacks in Chile in figures
View the data as a table
| Significant incident reports in 2026 | 566 |
| Reports in all of 2025 | 213 |
| Increase over 2025 | 166% |
| Operators of vital importance | 1,154 |
| Period | Significant incident reports | Approximate monthly average |
|---|---|---|
| March to December 2025 | 213 | 21 |
| First half of 2026 | 324 | 54 |
| July to October 15, 2026 | More than 240 | 70 |
| January 1 to October 15, 2026 | 566 | 60 |
Source: ANCI letter of October 23, 2026, via BioBioChile. The first-half figure was announced on October 1, at the launch of Cybersecurity Month. The monthly averages for the second and third periods are our own calculations from those figures.
Which sectors report the most cyberattacks in Chile
Government bodies remain first, but their share fell: they went from 46% of reports in 2025 to 29.7% in 2026, although almost one in three incidents this year hit a public entity. Digital service providers grew the most, with seven times as many reports, and power transmission went from 2 to 17. Banking, by contrast, stayed at around 7.
| Sector | 2025 | 2026 (through October 15) |
|---|---|---|
| Government bodies | About 98 | About 168 |
| Digital service providers | About 8 | More than 60 |
| Institutional health providers | About 20 | Almost 50 |
| Third-party managed technology services | About 10 | 41 |
| Digital infrastructure | About 7 | About 40 |
| Power transmission | 2 | 17 |
| Banking | About 7 | About 7 |
Source: BioBioChile, based on the ANCI letter; the outlet gave several sector figures as approximations, so they are not charted. In 2026, reports appear for the first time from drinking water, wastewater, maritime transport and pharmaceutical production, sectors added in the second stage of designating operators of vital importance, which began in November 2025.
More attacks or more reporting: what explains the rise in cyberattacks in Chile
Specialists consulted by BioBioChile do not read the figure as a wave of new attacks. Industry sources told the outlet that the increase mainly reflects more institutions reporting, which they see as a sign of compliance, and that there is no evidence that incidents in Chile are driven by AI-powered attacks.
Lawyer Cristóbal Luksic, of the firm Mendoza Luksic Valencia, warned that "there is still not enough information to draw conclusions" and attributed the rise both to the law taking effect and to a riskier digital environment. On the state's top spot, he said it is "a major handler of information." David Leal, of Innovacien, said his clients worry more about the new personal data law: "With the cybersecurity law, I never got an email from a client asking me for that update."
- More institutions covered: the final list of operators of vital importance reached 1,154 institutions in July 2026.
- More sectors: water, sanitation, maritime transport and pharmaceutical companies have reported since 2026.
- More digital providers: their reports multiplied sevenfold.
What the Cybersecurity Framework Law requires
Law 21,663, published on April 8, 2024, created ANCI and requires essential service providers and operators of vital importance (OIV) to report incidents that may have significant effects. Reporting has strict deadlines, and serious violations can lead to fines.
The law defines essential services to include, among others, power generation, transmission and distribution, drinking water and sanitation, telecommunications, digital infrastructure, digital services, transport, banking, health and government bodies. Within them, ANCI designates as operators of vital importance the institutions whose failure would have the greatest impact on the population. An incident is "significant" when it can disrupt the continuity of an essential service, affect people's physical safety or health, or when it affects systems that hold personal data.
| Obligation | Deadline or detail |
|---|---|
| Early warning to ANCI | Within 3 hours of learning of the incident |
| Report update | Within 72 hours |
| Final report | Within 15 days |
| Who reports | Essential services and operators of vital importance (1,154 institutions as of July 2026) |
| Since when | March 1, 2025 |
Sources: Law 21,663 and BioBioChile. The law's timeline, step by step:
- Apr. 8, 2024Law 21,663 is publishedIt creates the National Cybersecurity Agency (ANCI).
- Mar. 1, 2025Mandatory reporting beginsEssential services and operators of vital importance must report significant incidents.
- Nov. 2025Second stage of OIV designationIt adds sectors such as drinking water and maritime transport.
- Jul. 2026Final list: 1,154 institutions
- Oct. 1, 2026324 reports in the first halfFigure given at the launch of Cybersecurity Month.
- Oct. 23, 2026ANCI letter: 566 reports through October 15
- Dec. 1, 2026Original start date of the data protection lawThe Senate approved delaying it to October 15, 2027; the Chamber must still vote.
The personal data law, the other date worrying companies
Meanwhile, Law 21,719 on personal data protection was due to take effect on December 1, 2026. On October 28, the Senate approved a bill delaying it to October 15, 2027, which the Chamber of Deputies must still ratify, according to BioBioChile. Consumers, for their part, face another kind of digital risk: 20% of Chileans fell victim to online shopping scams, according to Norton.
Frequently asked questions
How many cyberattacks were reported in Chile in 2026?
Essential service providers and operators of vital importance reported 566 incidents with significant effects to ANCI between January 1 and October 15, 2026, according to an agency letter cited by BioBioChile.
Why did reports rise so much?
Mainly because more institutions are required to report and are doing so, according to specialists consulted by BioBioChile. The obligation began in March 2025 and new sectors were added in 2026.
Which sector reports the most incidents?
Government bodies, with about 168 reports in 2026, although their share fell from 46% to 29.7%.
How quickly must a cyberattack be reported to ANCI?
Law 21,663 requires an early warning within 3 hours, an update within 72 hours and a final report within 15 days.
What is an operator of vital importance?
An institution whose services are essential and which ANCI designates as such because of the impact an attack would have. As of July 2026 the list included 1,154 institutions.
