Chilean Joint Chiefs of Staff (EMCO) Guacamaya leak

In September 2022, the hacktivist collective Guacamaya disclosed a sweeping breach of Chile's Estado Mayor Conjunto (EMCO) — the Joint Chiefs of Staff responsible for the armed forces' intelligence, operations, and logistics — leaking a decade of military email and exposing some of the country's most sensitive defense material.

What happened

Guacamaya exfiltrated the contents of 162 EMCO email accounts, yielding more than 400,000 messages sent and received between 2012 and May 2022, with the bulk concentrated from 2018 onward. The leak was released to journalists and published in collaboration with investigative outlets including Chile's CIPER and the DDoSecrets transparency consortium.

According to the hackers, a Chilean cybersecurity company had warned EMCO of an exploitable vulnerability in August 2021, but the agency "chose to leave it open." The intrusion is widely associated with the exploitation of an unpatched flaw in internet-facing infrastructure — consistent with the Zoho ManageEngine ADSelfService Plus vulnerability (CVE-2021-40539) that Guacamaya used against several Latin American military and government targets in the same campaign.

What was exposed

The trove included highly sensitive operational documents, among them EMCO reports sent in 2021 and early 2022 to the Defense Minister detailing the daily security situation in the Biobío and La Araucanía regions — including deployed troop numbers, operational vehicles, patrol locations, critical-infrastructure protection points, and event reports. Internal correspondence on intelligence, procurement, and inter-service coordination was also exposed.

Part of a regional campaign

The EMCO breach was one chapter in Guacamaya's massive "Fuerzas Represivas" release, which dumped terabytes of data stolen from military and police institutions across Mexico, Peru, El Salvador, Colombia, and Chile. The group framed its actions as anti-imperialist hacktivism aimed at exposing state repression and the militarization of Latin America, declaring it would hand the data "to those who can legitimately do something with this information."

Why it matters

The Guacamaya leak was an unprecedented compromise of Chilean national-security information and triggered a political crisis: it contributed to the resignation of the head of the Joint Chiefs of Staff and intensified scrutiny of the armed forces' cyber hygiene. The most damning detail — that EMCO had been warned of the vulnerability more than a year earlier and declined to remediate it — made the incident a defining example of how unpatched, internet-exposed enterprise software can hand an entire defense apparatus to hacktivists. It accelerated Chile's push toward a national cybersecurity framework and dedicated state cyber-defense capabilities.