Peru denies ransomware breach amid Rhysida gang claims

The Peruvian government has firmly denied allegations that its main digital platform was compromised by the Rhysida ransomware group, despite claims by the hackers and the publication of alleged stolen data on their leak site.

Rhysida, a cybercriminal group with a track record of targeting governments and public institutions worldwide, listed Peru’s federal portal, gob.pe, among its victims and demanded a ransom of five bitcoin, equivalent to approximately $471,000. The group also published documents it claimed were extracted from the government’s website.

In response, Peru’s Ministry of Government and Digital Transformation issued a public statement on Thursday, asserting that the www.gob.pe platform remains secure and fully operational. “There has been no hijacking or breach of the domain www.gob.pe. All services continue to function normally,” the ministry stated, rejecting circulating reports on social media suggesting otherwise.

However, the government acknowledged a separate cyber incident involving the tax administration portal for the city of Piura (satp.gob.pe), which is not managed by the federal digital authority. This website experienced a cyberattack on March 29, according to local officials, briefly disrupting operations before services were restored within 48 hours. Piura’s tax agency reported the attack to provincial prosecutors and stated that no data was stolen.

The National Center for Digital Security (CNSD) was activated immediately following detection of the incident to implement risk mitigation strategies. Investigations are ongoing in coordination with both national and international cybersecurity entities, as well as the affected regional authority.

Federal officials emphasized that cyber incidents affecting state or regional agencies must be reported promptly to the CNSD. They also urged the public to rely solely on verified government communications and to avoid the spread of misinformation that could cause unnecessary panic.