URGENT WARNING: U.S. Security is Under Attack in Guatemala
This is not solely Guatemala’s responsibility; there is information regarding U.S. citizens, their investment properties, and their personal data. Cyber mercenaries are aware of this, as are those behind the scenes. I have not heard from President Bernardo Arevalo, who openly supports Iran, the “woke” agenda, Soros, etc.
We suggest that they come or speak with U.S. diplomatic authorities to seek support from the FBI, besides Mossad (Israel) . With the utmost respect, we urge Secretary of State Marco Rubio to take urgent action, because Guatemala should not be underestimated as a bridgehead for terrorists and their allies in this region.
Timeline of 21 days of cyberattacks: how Guatemalan institutions have been affected
In a matter of three weeks, websites of state institutions, universities, and public platforms have been infiltrated by hackers who have exposed sensitive data of thousands of Guatemalans and demonstrated that the country’s computer infrastructure is weak.
Since the beginning of April, there has been a series of cyberattacks, starting with the General Directorate of Arms and Ammunition Control (Digecam), up to the most recent, alleged breaches of the websites of the Attorney General’s Office (PGN) and the Superintendency of Telecommunications (SIT).
Experts consulted by La Hora have stated that the creation of a Cybersecurity Law is necessary to regulate what happens in cyberspace; however, it is still in the Congress of the Republic awaiting a new ruling.
Meanwhile, President Bernardo Arévalo assured that the Government is already working on a response to cyberattacks and stressed that the Government will not wait for the approval of said legislation to act.
“We can’t wait until the law comes out; we are looking at what measures can be taken to close those gaps,” he said.
THE BEGINNING OF THE INTRUSIONS: DIGECAM
April 9 marked the beginning of this series of incidents. On that day, the Guatemalan Army reported that it was investigating an alleged data theft at Digecam.
Initially, authorities claimed to have no evidence confirming the breach, although they activated security and monitoring protocols.
Hours later, the tone changed. The Army spokesperson confirmed that a hack had indeed occurred. Although she insisted that user information “was not at risk,” a forensic audit and a mass password reset were ordered as a containment measure.
The official argument was that the data was not sensitive, since it was information that had always been public, and that the passwords were protected by hashing. However, the hacker obtained the personal information of gun owners in the country, as well as all the details of the firearms that are validated for circulation.
Days later, on April 21, the case moved towards the identification of a suspected perpetrator, who calls himself “Gordon Freeman” and allegedly operated from abroad .
However, doubts remained, as they stated they did not know whether it was an individual or an organized group, nor what their motivations were. The institution maintained that no critical infrastructure or databases were compromised .
CYBERATTACK ON HEALTHCARE, BUT CONTENT
While the Digecam case was still under investigation, the Ministry of Health confirmed another incident. The website of the National Health Laboratory suffered an attack which, according to the official version, was quickly contained.
The incident was reported on April 13, but it reportedly began on March 9 and was brought under control the following day. According to the Ministry of Health, it involved the encryption of internal files using ransomware or a Trojan horse.
Authorities assured that there was no access to sensitive data, but the incident revealed a vulnerability: the access would have occurred through the web portal and with the use of tools to hide the origin, such as VPN.
Although the systems were restored using backups, the incident forced the reinforcement of controls, the review of access points, and the filing of complaints with the Public Prosecutor’s Office (MP).
THE BIGGEST ATTACK: A CODE BREACH AT THE MINISTRY OF LABOR
On April 26, the focus shifted to the Ministry of Labor. The “Tu Empleo” portal, a job search platform for citizens, temporarily stopped working after an attack.
Subsequent investigation confirmed that the breach originated in an outdated programming language (API) , which allowed the intrusion. The platform was preemptively disabled while the vulnerability was patched.
The attack allowed hackers to steal personal data and sensitive information from users of the platform, as well as their resumes.
©2026 Editorial Board – DrRichSwier.com. All rights reserved.
RELATED ARTICLE: The timeline of hacks in Guatemala: three hackers allegedly breached state institution websites







