Ransomware at one software supplier knocks out councils in five Argentine provinces
An attack on a Córdoba company that runs tax and administrative software for local governments halted payments and procedures at town halls from Santa Cruz to Corrientes. The full number of councils affected is not yet known.
A ransomware attack on Program Consultores S.A. (PGM) took municipal systems out of service in five Argentine provinces, Diario Popular reported. PGM is a Córdoba company that supplies administrative and tax management software to local governments. The incident was registered on Friday 23 October. Councils in Córdoba, Santa Fe, Santa Cruz, San Luis and Corrientes had to suspend administrative procedures, the collection of local fees and digital services.
PGM's software serves more than 250 municipalities and communes in 11 provinces, according to Diario Popular.
Which councils were hit
Diario Popular names 22 localities among those affected, and says there is no definitive count yet. In Córdoba it names Villa Carlos Paz, Cosquín, Oncativo, Almafuerte, Tío Pujio, Villa Giardino, San Marcos Sierras, Cuesta Blanca, La Cumbrecita, Achiras, La Falda, La Cumbre, Valle Hermoso, Tanti and Villa Santa Cruz del Lago. Elsewhere it lists Roldán, Cañada de Gómez and Avellaneda in Santa Fe, Río Gallegos and El Chaltén in Santa Cruz, Villa de Merlo in San Luis and Goya in Corrientes.
Some municipalities officially confirmed that their systems had been interrupted, while others found problems reaching their digital platforms, the outlet reported. Río Gallegos said all of its computer systems were out of service. In Villa Carlos Paz the outage hit municipal fees and revenue services and prevented some tax payments and procedures linked to issuing tax bills. The municipality of Avellaneda said its computer systems had suffered an unauthorised entry.
In the Punilla area of Córdoba, the attack took down the servers of several municipalities, including La Falda, Villa Giardino, La Cumbre, Valle Hermoso, Cosquín, Tanti and Villa Carlos Paz, and stopped payments and procedures, La Estafeta Online reported.
Ransom demands and the company's account
Some municipalities received ransom demands of up to three bitcoins to restore their systems, according to La Estafeta Online. Diario Popular reported the same figure and said it had not been made public whether any payment was made.
In a statement sent to the municipalities, PGM said there had been no theft or leak of data, La Estafeta Online reported. The company described the incident as a virus that encrypted files and left some municipalities' servers inoperative, and said it affected only the server infrastructure where its systems are hosted. PGM also said that no confidential information was extracted, that no databases were leaked and that its applications work correctly, according to Diario Popular.
PGM said the attack was not related to the vulnerabilities reported by the official PHP team, according to La Estafeta Online. Those flaws in widely used website software led public bodies in Australia and Europe to take websites offline, as IQGov reported.
What is not yet known
Municipal IT staff and the company are working together on recovery, but there is no estimated time for the systems to be restored, La Estafeta Online reported. Diario Popular also said there was no confirmed timetable for systems to return to normal. The total number of councils affected is not settled, neither report says how the attackers got in, and it has not been made public whether any ransom was paid. IQGov has not read a statement directly from PGM or the municipalities; their positions here come from the two outlets' reports.
Editor-in-chief,
Fazilat Ghobadinezhad is IQGov's editor-in-chief. She decides what IQGov covers and edits its stories. IQGov's stories are researched and drafted by AI agents to our editorial rulebook, checked against their sources by a separate fact-checking agent, and approved before publication. Every fact links to its source.
