CHILE · CYBERSECURITY
Key Facts
- —The country Chile is a copper-rich South American economy where Copec, Esmax and Enex are among the main fuel distributors.
- —Why it matters Chile’s new cyber law can fine designated “vital operators” heavily, and fuel suppliers say the label does not fit them.
- —Why now By Friday 23 October 2026 Aramco’s Chilean unit Esmax and fuel firm Enex had joined Copec in challenging the list in court.
- —What happened Esmax and Enex asked Chile’s courts to reverse their place on the list published on 24 July, as Copec and mining groups did earlier.
- —The numbers The maximum fine for a vital operator is 40,000 monthly tax units, about CLP 2.89 billion (about US$3 million), and the 24 July second-stage list names 239 entities.
- —What it means for you Fuel buyers, miners and foreign owners such as Aramco face new cyber duties and costs if the agency wins, and delays if the courts side with the firms.
- —Still open Whether the Santiago appeals court removes any company from the list, and how it weighs manual back-up against the agency’s view of digital dependence.
- —Power Index Chile ranks 3rd of 14 in The Rio Times Latin America Power Index, with 63.6 points (October 2026 edition).
Esmax, the Chilean fuel unit of Saudi oil giant Aramco, and the fuel firm Enex have joined Copec in fighting the Chile cybersecurity list, La Tercera reported on Friday 23 October 2026. All three argue that petrol stations and depots can keep running by hand, so they should not be named “vital operators” with fines of up to about US$3 million.
For US readers the case is an early test of how Chile treats foreign-owned energy assets under its new cyber law. Aramco bought 100% of Esmax Distribución and completed the deal on 1 March 2024, according to its own release.
The latest list was published by Chile’s National Cybersecurity Agency, known as ANCI, in the official gazette on 24 July 2026 as Exempt Resolution 187. Our guide Who Runs Chile’s Economy, the Key Players in 2026 explains the fuel and mining groups involved.
What Esmax and Enex Told the Court
Enex, which holds the Shell brand licence in Chile, asked the Santiago appeals court to be left off the list. It argues that receiving, storing and dispatching fuel at its plants is physical and mechanical work, with manual procedures that keep supply going even if its systems fail.
Esmax accepts that it is an “essential service provider” because it distributes fuel. It rejects the stricter “vital operator” label, saying the agency did not show the two legal conditions that the law requires.
Esmax points to 2021, when it says it ran for 72 hours without its central system during a technology migration. It says it used manual procedures, paper records and delivery guides to keep distributing fuel.
Both firms say the label brings disproportionate duties and immediate regulatory costs. They cite fines that can reach 40,000 monthly tax units, a figure La Tercera put at about US$3.1 million.
Copec’s Case and the Agency’s Reply
Copec, the fuel arm of the Angelini group’s Empresas Copec, was named in the agency’s April draft list and sent comments. It says those comments were not reflected in the final list, and that it received a 374-page file on 31 July.
Copec says that file contains no document written by the agency itself applying a method to the company or explaining the decision. It also says each of its storage plants can run on local, isolated systems, and that its stations kept fuelling by hand during the national blackout of 25 February 2025.
ANCI told the court in late August that Copec does depend on networks and systems. It listed tank-monitoring telemetry, interconnected electronic payment coupons using RFID chips, and platforms that coordinate fuel dispatch.
The agency also noted that Copec is the only fuel supplier in several remote towns, including Futaleufú, Hualaihé, Porvenir and Cabo de Hornos. With little back-up supply, it argued, any disruption could have a significant impact.
How the Chile Cybersecurity List Works
Chile’s framework cybersecurity law, number 21,663, lets ANCI name essential service providers as vital operators when two conditions are met. Their service must depend on computer networks and systems, and an attack on it must have a significant impact on public order, essential services or the State.
A vital operator must run a continuous information-security system, keep records and certify continuity plans. It must also run drills, appoint a cybersecurity delegate, train staff and report to the national response team.
Fines scale with the seriousness of the breach. A minor breach carries up to 10,000 monthly tax units for a vital operator, a serious one up to 20,000 and a very serious one up to 40,000, double the 5,000, 10,000 and 20,000 units that apply to other covered firms.
The tax unit stood at CLP 72,151 in October, according to Chile’s tax service, so 40,000 units is about CLP 2.89 billion (about US$3 million at the central bank’s observed rate of CLP 976.82 on 22 October). La Tercera used a slightly higher dollar figure of US$3.1 million.
Companies have 15 working days after notification to file a legality challenge in a court of appeals. The court may also order the act suspended if carrying it out could cause irreparable harm.
The Wider Wave of Challenges
Our earlier report covered the first wave, when La Tercera reported in August that twelve entities went to court after the 24 July resolution, which named 239 entities in sectors from fuel and water to telecoms and drug production. They included three Antofagasta Minerals mines, Zaldívar, Antucoya and Centinela, plus Copec and the UC Christus health network.
Mining firm Sierra Gorda has also challenged its listing as an electricity operator. It says it runs a substation only for its own mine and sells no power to the public, so a failure would not significantly affect the population.
Two hospital concession companies and a prison concession in Talca have also gone to court, La Tercera says. One hospital operator says its platform is only a digital works log, not linked to clinical equipment, and the prison company says Gendarmería controls the security systems.
ANCI has called the challenges a normal part of the process the law created. It told La Tercera in August that firms in newer sectors tend to see less cyber risk in themselves.
What It Means for You
Investors in Chilean fuel, mining and health groups should watch the cost of cyber compliance and the risk of fines if the courts back ANCI. Foreign owners such as Aramco face the same duties as local groups, which matters for any company weighing assets in Chile.
Drivers and businesses are unlikely to notice a change at the pump from the list itself. The agency’s argument about remote towns shows why regulators treat single-supplier fuel networks as a security matter.
Our Copec Charged Over Quintero Bay Pollution report covers a separate regulatory case against the same fuel group. For wider context see Chile Natural Resources Explained 2026, our guide to foreign players in Chile and the Santiago expat city guide.
What Is Not Known
No ruling by the appeals court has been reported on any of the challenges, and court case numbers were not found. The details of the Esmax and Enex filings come from a single newspaper account, so they remain the companies’ own arguments.
It is not known whether the court will suspend the listings while it decides. Neither is it known how the agency will respond to the new filings, or whether Copec’s 374-page file contains material beyond what the company describes.
The Rio Times could not open the filings themselves or the full gazette resolution. The dollar values here are our calculation from the tax-unit value and the central bank’s observed rate, and no fine has been imposed on any of the companies.
Frequently Asked Questions
What is the Chile cybersecurity list?
It is the second-stage register of vital operators that ANCI published on 24 July 2026, naming 239 entities and bringing the total to 1,154 across both stages. Companies on it face stricter cyber duties and higher fines under Law 21,663.
Which fuel companies are challenging it?
Copec, Aramco’s Chilean unit Esmax and the Shell licensee Enex have all gone to court. La Tercera reported the Esmax and Enex filings on 23 October.
How big can the fines be?
A very serious breach by a vital operator can cost up to 40,000 monthly tax units. That is about CLP 2.89 billion, or about US$3 million.
Why do the firms say they should not be listed?
They say fuel supply does not depend on their computer networks and can run by manual procedures. The agency answers that tank telemetry, electronic payments and dispatch platforms do rely on networks.
Has any court ruled yet?
No ruling has been reported. The challenges are before the Santiago appeals court, and ANCI has answered at least the Copec case.
Sources: La Tercera, 23 October 2026; La Tercera, August 2026; Eguiguren Abogados, 10 August 2026; Law 21,663, Chile’s framework cybersecurity law (Library of Congress); Aramco, 1 March 2024; Chile tax service, tax unit values 2026; Central Bank of Chile, observed dollar.
This article was produced by The Rio Times’ automated newsroom system. How we use AI · Report an error · Editorial responsibility: Matthias Camenzind, Editor-in-Chief