La inteligencia artificial entró a lapicerasXtracted y se llevó historias clínicas de sanctuarios argentinos

La technology digital nos promete que soon it will save us time. This campaign is not about saving time: it is about automated intrusions that compromised at least 15 health institutions in Argentina between May and August 2026.

According to the report by cybersecurity company CrowdStrike, the attackers used a system with two artificial intelligence agents. One decided the next step of the intrusion and the other carried it out. When a technique failed, the system changed strategy on its own. In one Argentine case, it reached an Active Directory server, which manages an organization's authentications, approximately 20 minutes after receiving the initial instruction.

A bridge between two health institutions

The system also connected two already compromised health organizations without receiving an explicit instruction. According to the reconstruction, the artificial intelligence detected that access to the first entity could serve as a bridge to the second. In 12 minutes and a half, it examined files and configurations and found a route to an internal server of the other organization.

At least one institution suffered the extraction of access credentials and medical records. CrowdStrike did not identify the affected entities and did not specify how many patients had their data exposed. The investigation was possible because the attackers left the directories containing the tools used in the attack accessible on the internet, allowing researchers to review the instructions, responses and actions executed by the agents.

“Imaginate que logró alcanzar un Active Directory, un servidor por el que básicamente pasan todas las autenticaciones, en apenas 20 minutos.”Marcos Ferreira, vicepresidente de ingeniería de ventas para América Latina de CrowdStrike

The company also warned that this type of autonomous offensive grew globally by 89 percent during 2025. The uncomfortable part, as usual, is that the tools work fast, adapt and do not need to be told twice. In my case, that would be great for household chores and disastrous for protecting health data.

• La campañacomprometió al menos 15 entidades sanitarias argentinas entre mayo y agosto de 2026.
• De una de las instituciones se extrajeron credenciales de acceso e historias clínicas.
• El informe no identifica a las organizaciones afectadas ni precisa la cantidad de pacientes expuestos.
• El acceso al servidor central de autenticación documentado se produjo en aproximadamente 20 minutos.
• CrowdStrike registró un crecimiento global del 89 por ciento en ofensas autónomas durante 2025.

Practical advice: strengthen authentication controls, review access credentials and treat any artificial intelligence tool connected to critical systems as what it is: a very fast operator with a very bad sense of boundaries. The advice is simple, although institutions often make it complicated: do not leave the keys in the same place as the lock.