SERNAC government ransomware attack

On 25 August 2022, Chile's Servicio Nacional del Consumidor (SERNAC) — the national consumer-protection agency — was hit by a ransomware attack that encrypted its servers and disrupted its systems and online services, becoming one of the most prominent attacks on a Chilean public institution that year.

What happened

The incident targeted the Microsoft and VMware ESXi servers on SERNAC's corporate networks. The ransomware had the capability to stop all running virtual machines and then encrypt files, which took on the .crypt extension. The attacker gained full control of the affected systems and left a ransom note specifying the volume of data it claimed to have seized.

Because the malware specifically targeted VMware ESXi hypervisors, it could disable large numbers of virtualized workloads at once — a technique that had become increasingly common in 2022. Security researchers who analyzed the sample noted behavior consistent with the RedAlert (also tracked as N13V) ransomware family, which was purpose-built to encrypt ESXi environments on both Windows and Linux.

Government response

Chile's government Computer Security Incident Response Team (CSIRT), the cybersecurity authority within the Ministry of Interior, escalated the SERNAC incident into a state-wide cybersecurity alert on 29 August, instructing all government agencies and partner entities to review their defenses, apply mitigations, and watch for the indicators of compromise associated with the attack. The alert reflected concern that the same actor or technique could spread across other public bodies.

Impact

• SERNAC's systems and online services were interrupted, affecting the agency's consumer-protection operations.
• Files on the compromised Microsoft and VMware ESXi servers were encrypted with a .crypt extension.
• The Chilean government issued a national-level alert to the entire state apparatus as a precautionary measure.
• There is no public confirmation that a ransom was paid.

Why it matters

The SERNAC attack came in a year when ESXi-targeting ransomware surged globally, exploiting the fact that a single hypervisor compromise can encrypt dozens of virtual servers simultaneously. For Chile, hitting a consumer-protection regulator just months after the Guacamaya military leak reinforced a perception of systemic weakness in public-sector cyber defenses and added urgency to the country's legislative push for a National Cybersecurity Framework and a dedicated National Cybersecurity Agency (ANCI). The CSIRT's rapid escalation to a whole-of-government alert also illustrated a maturing, if still reactive, national incident-response posture in which one agency's breach is treated as a warning to all.