Dirección Nacional de Migraciones Netwalker ransomware attack

On 27 August 2020, Netwalker ransomware struck Argentina's Dirección Nacional de Migraciones, the national immigration agency — one of the first ransomware incidents to directly disrupt a country's border-control operations.

What happened

Around 7 AM, immigration offices across Argentina began reporting that they could not access their systems. The Netwalker (also known as Mailto) ransomware had encrypted Windows servers and workstations, targeting Active Directory SYSVOL, System Center DPM, and Microsoft Office files across shared directories and user machines.

The agency's Sistema Integral de Captura Migratoria (SICaM) — the system that processes entries and exits at international checkpoints — was particularly affected. To stop the malware spreading, Migraciones shut down the computer networks at its offices and border posts, suspending all border crossings into and out of Argentina for roughly four hours until servers could be restored from backups.

The ransom

The Netwalker operators left a ransom note demanding $2 million in cryptocurrency, posted to a dark-web payment portal that displayed samples of stolen data. The note warned that the amount would increase if not paid within seven days. When the deadline passed, the demand rose to $4 million — approximately 355 bitcoins.

The Argentine government, through the Ministry of Interior, stated firmly that it would not negotiate with the attackers and expressed little concern about ransom-based data recovery, relying instead on restoration from backups. After payment was refused, the operators leaked roughly 1.8 GB of internal documents as retaliation.

Impact

• All Argentine border crossings were suspended for about four hours, an unprecedented operational impact from ransomware on national infrastructure.
• Stolen and partially leaked data included internal administrative documents; reporting also referenced records tied to repatriations during the COVID-19 pandemic.
• Operations were restored from backups; no ransom was paid.

Why it matters

The Migraciones attack was a landmark demonstration that ransomware could halt a sovereign function — the ability to control who enters and leaves a country — not merely encrypt corporate files. Netwalker operated as a ransomware-as-a-service affiliate program and was among the most prolific extortion operations of 2020, targeting hospitals, universities, and governments worldwide before a coordinated international law-enforcement action in January 2021 seized its infrastructure and charged a key affiliate. Argentina's decision to refuse payment and restore from backups became a reference point for public-sector ransomware response in Latin America, while the four-hour border closure underscored how thin the operational margins of critical government systems can be.