How Peru Became Latin America's Most-Attacked Country While Chasing an AI Future

Peru's corporate sector has made AI its top business priority for 2026—but a parallel crisis is mounting in plain sight. Between January and May of this year alone, the country recorded 353,530 cyberthreat detections spanning 1,337 distinct malware families, with monthly peaks surpassing 83,000 events in March and April, according to ESET's Security Days 2026 presentation in Lima. The same technologies driving Peru's innovation wave are being turned against its businesses.

This collision between rapid AI adoption and widening cybersecurity gaps is no longer a future risk. It is a present-day threat to operational continuity, customer trust, and regulatory standing for Peruvian organizations of every size.

Peru Leads the Region in AI Adoption—and in Cyber Exposure

The scale of Peru's AI push is significant. A survey of Peruvian companies cited in a recent industry analysis found that 81% report active AI engagement: 21% have already completed implementation, 37% are in the process of deploying during 2026, and 23% are running proof-of-concept projects. In regional terms, Peru's 37% active-deployment rate outpaces Chile at 32% and Argentina at 18%.

Investment intentions are just as ambitious. According to the CIO Playbook 2025 study by Lenovo and IDC, Peruvian companies projected a 3.9-fold increase in AI spending within their total IT budgets—the steepest growth rate in all of Latin America. The enthusiasm extends to ROI expectations: 88% of Peruvian businesses anticipate positive returns on their AI investments, projecting an average yield of up to 2.3 times the initial outlay, according to the same research.

But that confidence is outpacing the security infrastructure required to contain it. One of the primary risks flagged by the Cámara Peruana de Inteligencia Artificial (CPIA) is the routine use of AI platforms without internal policies defining which tools are authorized and what company data may be shared with them. In practice, employees are feeding sensitive client information into AI systems that operate without any oversight framework.

The Cyberattack Landscape Has Shifted—and Social Engineering Is Winning

Rather than relying on sophisticated zero-day exploits, attackers are increasingly using a task-delegation approach: the user, by interacting with files that appear routine—malicious PDFs, fake CAPTCHAs—unknowingly triggers the download of malware. Mario Micucci, a cybersecurity researcher at ESET Latinoamérica, explains that once attackers gain a user's trust, the user effectively completes the attack on their behalf. More than 45% of all detections recorded by ESET through May involved social engineering campaigns, phishing, malicious scripts, and downloaders.

For corporate targets, the consequences go beyond inconvenience. Documented impacts include Business Email Compromise fraud, lost access to cloud systems, ransomware incidents, and confidential data leaks. The exposure is already visible and verifiable: a dark web monitoring study by Soluciones Virtuales Perú found that sensitive information from 240 Peruvian companies has been exposed on dark web forums, covering more than 90 distinct categories of data—from employee credentials to financial records and credit card details.

AI Is Also Arming the Attacker

The same generative AI tools being adopted inside boardrooms are being weaponized externally. Deepfakes are moving from a fringe curiosity to a structural corporate risk—particularly within critical processes such as payment authorizations, executive communications, and vendor management. The absence of universal standards for labeling AI-generated content is pushing companies to develop their own verification mechanisms, a costly requirement that most Peruvian small and midsize businesses are not equipped to meet.

The modern ransomware model now operates on double extortion: attackers first steal data, then encrypt it—threatening to publish customer records on dark web forums if the ransom goes unpaid. High-profile Peruvian cases, including a 3.7 TB breach at Interbank that compromised data from over three million customers, confirm that no sector is immune.

The Regulatory Clock Is Running

Peru's legal framework is tightening simultaneously. Under the new regulation of Ley N° 29733 on personal data protection—which took effect on March 31, 2025—companies must notify the Autoridad Nacional de Protección de Datos Personales (ANPD) of any security incident within 48 hours of becoming aware of it. Missing that window exposes organizations to sanctions that compound the financial damage of the breach itself.

Enforcement is no longer theoretical. In 2025, the ANPD inspected 760 entities—a 67% increase over the prior year—initiated 136 sanction proceedings, and issued fines totaling S/ 11.3 million. Peru has also enacted a dedicated regulatory framework for AI, which will impose new disclosure and governance obligations on businesses operating in the medium and long term.

Governance Gap: The Real Bottleneck

While 52% of Peruvian executives cite AI adoption as a strategic priority, a Gestión survey found that nearly two-thirds of companies have made only limited progress—deploying the technology in scattered, uncoordinated ways, without clear governance. Only 10% of Peruvian firms have formally approved internal AI policies, according to EY Peru's AI & Boards 2026 study, even as 78% of executives acknowledge the technology improves the quality of their decisions.

In response to mounting pressure, cybersecurity spending is accelerating. According to the EY Cybersecurity Roadmap Study released in March 2026, the share of cybersecurity budgets dedicated to AI-powered defenses is expected to surge from just 9% today to nearly half within two years, as organizations race to use AI both offensively and defensively.

The KPMG Cybersecurity Considerations 2026 report draws a clear conclusion: accelerated AI adoption, growing dependency on third-party technology vendors, and the digitization of critical business processes require organizations to move decisively from a compliance mindset to a full resilience strategy.

The message for Peruvian businesses is unambiguous: the era of experimenting with AI outside any security framework is over. The next competitive differentiator will not be which company adopts AI fastest—but which one can translate that investment into efficiency and resilience without becoming the next data breach headline.

© {{Year}} Latin Times. All rights reserved. Do not reproduce without permission.