IFX Networks supply-chain ransomware attack

In September 2023, a ransomware attack on IFX Networks — a regional cloud, hosting, and connectivity provider — turned into one of the most disruptive supply-chain incidents in Latin American history, cascading from a single technology vendor into the heart of the Colombian state.

What happened

On 12 September 2023, threat actors deployed ransomware inside IFX Networks' infrastructure, encrypting systems that hundreds of customers relied on for hosting and data storage. Because so many Colombian institutions outsourced services to IFX, the impact rippled outward almost immediately.

The Ministry of Health and Social Protection, the Judiciary Branch, and the Superintendency of Industry and Commerce all reported that they could no longer function normally. One affected database reportedly held over 50 million records belonging to the Ministry of Health. The Judiciary was forced to suspend procedural deadlines nationwide as courts lost access to case-management systems.

Scale

President Gustavo Petro stated that more than 50 Colombian state and private entities were hit. The Office of the President later said the attack affected 762 companies across Latin America, with IFX supplying services to organisations in 17 countries on the sub-continent. The breadth made it a textbook demonstration of concentration risk: compromising one managed-service provider yielded simultaneous access to dozens of downstream victims.

Attribution

No ransomware group publicly claimed the attack at the time. However, researchers at elHacker.net circulated material suggesting the RansomHouse extortion group — already linked to the 2022 Keralty health-network breach in Colombia — may have been responsible. IFX Networks itself confirmed it had suffered a ransomware incident affecting a subset of its hosting platform.

Government response

The Colombian government took an unusually combative posture toward its own vendor. ICT Minister Mauricio Lizcano said he had ordered administrative actions against IFX Networks and was coordinating a civil lawsuit and a possible criminal case, alleging that the breach resulted from the company's negligence and that IFX's communication with affected clients was inadequate. The Attorney General's office opened an investigation.

Why it matters

IFX Networks crystallised the danger of state dependence on third-party cloud providers without enforceable security and incident-response guarantees. A single compromised vendor degraded health services, halted court proceedings, and disrupted regulators across an entire nation — and beyond its borders. The incident accelerated debate in Colombia and the wider region over supply-chain due diligence, mandatory breach notification for critical suppliers, and the resilience of outsourced public-sector IT.