Cyberattack on Digecam: what happened and what companies can learn

News

What was reported

According to Infobae (April 11, 2026), the Guatemalan Army confirmed a cyberattack on the Directorate General for Arms and Munitions Control (Digecam). According to that report:

• The incident occurred on April 10, 2026 and lasted approximately 13 hours.
• Sensitive information on holders of firearm licenses and registrations was compromised; a preliminary report mentioned up to 5 gigabytes of stolen information.
• User credentials were compromised.
• The affected licenses and registrations were ordered voided and replaced free of charge, with new numbers and records, and a complaint was filed with the Public Prosecutor's Office.
• According to reports, there was no file encryption or ransom demand.

Congress also carried out oversight actions on the case.

Analysis

Why it matters beyond the public sector

The case illustrates a pattern that also affects companies: the damage doesn't end when the attack is contained. Replacing documents, contacting those affected and rebuilding trust consumes time and resources. In addition, data linking identities to valuable assets can be used for extortion, fraud or physical crimes: a clear example of how digital risk becomes physical risk.

Recommendation

What to do in your organization

• Classify which data, if leaked, would put customers or employees at physical risk, and protect it with reinforced controls.
• Require multi-factor authentication on every account with access to sensitive data.
• Prepare in advance the procedure to notify those affected and replace credentials.
• Monitor anomalous access and define who decides in the first hours of an incident.