Cyber incidents

Primary delivery: smuggled phones in CDMX prisons (Reclusorio Norte, Reclusorio Oriente) and Tamaulipas / Nuevo León penitentiaries. 2024-25 sees heavy adoption of AI-cloned voice ('your relative crying for help') driven by stolen social-media voice samples + commercial deepfake tools. Average ransom: 5,000–80,000 MXN, paid via OXXO Spin, Bitso, or wire to mule accounts.

Shell companies sold online to issue fake deductible CFDI invoices. Major cartel money-laundering vector — UIF investigations consistently link CFDI rings to Sinaloa, CJNG, and CDN financial cells. SAT publishes the EFOS (Empresas que Facturan Operaciones Simuladas) list publicly but enforcement lags.

Card cloning, online-banking fraud, SIM-swap take-overs, mule-account laundering. Tourist corridors (Cancún, Cabos, Puerto Vallarta) over-represented in skimmer reports. Real losses estimated 4-5× the reported figure due to under-reporting; CONDUSEF only sees disputes that go formal.

Spike after 2022 mobile-number portability changes loosened identity verification at carrier counters. Telcel, AT&T MX, and Movistar all named in CONDUSEF complaints. Bypasses SMS-based 2FA on banking, crypto exchanges, and social media.

Cancún, Playa del Carmen, Cabo San Lucas, Puerto Vallarta. Operators were primarily Eastern European crews historically; now increasingly local cartel-aligned. Pump skimmers at PEMEX gas stations on Mex 200 / Mex 15 also a recurring theme.

Mexico is a destination for compounds operated by Asian-linked syndicates running 'sha zhu pan' (pig butchering) romance-investment scams against primarily US victims. Properties identified in Los Cabos, Riviera Maya, periphery of CDMX. Some operators reportedly trafficked in. Intersects with cartel real-estate fronts and protection rackets.

Companion entry to the discrete INAI dissolution event. Private-sector breach disclosure / sanctioning vacuum lasting ≥ 6 months while transitional rules are drafted. International-investor attention via USMCA labor + privacy frameworks.

Permissive hosting rules + weak enforcement put MX in NCMEC's top 5 globally for reported CSAM material. The FGR specialized cyber unit handles fewer than 100 prosecutions / yr against millions of NCMEC reports.

Sustained intrusion attempts against CFE corporate and SCADA segments through 2024-2025. Attribution unclaimed; activity overlaps with patterns associated with state-sponsored APT campaigns reported by US allies.

CJNG-affiliated operators using social media + leaked address data to dox business owners and demand piso payments via crypto wallets and OXXO Spin transfers. Reported pattern of doxing → physical visit if ignored.

Major derivative stories surfaced from the original 6TB cache include: Encinas Pegasus targeting (Apr 2023), Cienfuegos US-MX coordination memos (Jun 2023), AMLO health files (Jan 2023), Ayotzinapa internal review notes (Sep 2023). The underlying breach is closed but each new round of reporting compounds the political damage.

Citizen Lab, R3D and Article 19 documented SEDENA's continued procurement and deployment of NSO Group's Pegasus spyware after AMLO's 2018 commitment to halt federal use. Confirmed targets include Aristegui Noticias staff, deputy interior minister Alejandro Encinas (during the Ayotzinapa investigation), Centro Prodh attorneys, and US-MX-border journalists. Procurement contracts surfaced via the 2022 Guacamaya leak; subsequent infections detected as recently as 2024.

Cyberattack disrupted municipal payment portals, public-records lookup, and vehicle registration services for roughly two weeks. Mayor's office initially denied a ransom demand; subsequent disclosures suggested operational data was exfiltrated.

Reported intrusion across multiple SRE servers, exposed in the wake of the Guacamaya leak. Scope includes consular data and bilateral diplomatic correspondence. Investigation ongoing; attribution unclaimed.

Sheinbaum's 'austerity' constitutional reform formally dissolved the autonomous data-protection regulator (DOF Dec 2024) and absorbed its functions into the executive's anticorruption secretariat. LFPDPPP private-sector enforcement effectively paused; private breaches no longer have a primary regulator with sanctioning authority. R3D and Article 19 flag this as a structural cyber-risk multiplier.

Municipal website and online services taken offline for approximately a week. Caborca is a notable target given its position in the Caborca Cartel war; intersection of cyber and physical extortion not ruled out.

Sustained intrusion attempts + DDoS during the June 2 2024 federal election cycle. INE confirmed nation-state-grade probes; PREP (preliminary results system) saw delayed availability windows attributed to traffic flooding. No confirmed breach of the voter-registration database; activity slowed but did not stop the count.

State payroll, vendor contracts and citizen-service records exposed via a misconfigured admin portal. State-level cybersecurity unit took 9 days to confirm; opposition lawmakers requested federal audit.

Citizen-service portal compromised; PII of property-tax filers exposed. Brief website defacement preceded the data leak.

Ransomware deployment against multiple state agencies. Public services partially restored within 5 days from offline backups; ransom demand and payment status not disclosed.

Database leak surfaced on a clearnet forum claiming ~36M Telcel customer records. Telcel disputed scope; researchers verified at least several million entries with full names + tax IDs (RFC) + addresses.

Defensive restructuring rather than an incident: SEDENA migrated off the vulnerable Zimbra email stack, stood up the CCESI cyber-command center, and centralized incident response under a unified J6/J2 structure. No public details on subsequent OPSEC posture; outside researchers (R3D, Article 19) still rate cyber-exposure as high.

Largest cyber leak ever against the Mexican state. ~6 TB / ~4M internal SEDENA emails published, part of a multi-country LatAm campaign that also hit Chile's Joint Chiefs, Peru's army, Colombia's national police, and El Salvador. Vector: unpatched Zimbra mail server (CVE-2022-27925, public PoC at the time). Contents exposed surveillance of journalists, AMLO's medical records, internal cartel-cooperation deliberations, friction with DEA/FBI on shared operations, and sicario rosters from cartel sources. Continues to fuel named-source journalism three-plus years later.

Multi-day disruption to fare-card and operational systems. CDMX government attributed to a 'cyber incident' without formally confirming ransomware; multiple researchers identified IOCs consistent with Lockbit affiliate activity.

Ransom demand unpaid; Avaddon published ~50 GB of internal contracts, financial records and employee data on its leak portal. Drawings and operations continued via backup systems.

DoppelPaymer demanded ~$5M USD; Pemex refused. Approximately 5% of corporate IT systems affected, no impact on production. Highlighted gaps in MX critical-infrastructure cyber posture.

Multiple low-grade incidents across 2019-2024: forum-leaked taxpayer records, phishing campaigns spoofing SAT notifications. No mass dump confirmed; cumulative exposure is significant.

Approximately 300M MXN (~$15M USD) drained via fraudulent SPEI transfer instructions injected through compromised connections at several member banks. Banxico imposed mandatory backup-link operating mode for all participating institutions.