Mexico: Cyberattacks Cost Financial Firms $120M

Between January and May 2026, cyberattacks caused losses of more than 120 million pesos for Mexican financial firms, according to press coverage citing Bank of Mexico data. Most of the damage was concentrated at a single bank, with 95.46 million pesos tied to two incidents reported in February and May, according to a report by La Jornada Zacatecas.

Where were the biggest losses concentrated?

The largest losses tied to those incidents were concentrated at one bank, which accumulated 95.46 million pesos between February and May, according to coverage citing Bank of Mexico data. That total stems from two separate events, both within the same period reported in the press.

The available reference does not identify the affected institution by name in the material provided. It also does not allow, based on these sources, a determination of whether there were other cases with smaller losses inside Mexico's financial system during those months.

What controls are attributed to the CNBV?

An executive quoted by El Economista said the CNBV's requirements for financial technology infrastructure include data center certifications, environmental controls, physical and digital protection, and documentary evidence on access, intrusion attempts, and activity logs. The report, however, does not present an official CNBV resolution confirming those requirements.

That same material places cloud services as an increasingly common option for financial firms to deploy products, although the publication does not add any new regulation or an official deadline linked to those controls. Based on the available information, only what is attributed by the journalistic source can be reported, not a confirmed rule from the regulator.

What can be verified and what cannot?

It can be verified from the sources provided that Mexico's financial sector faced losses above 120 million pesos between January and May 2026, and that at least a significant share was concentrated in one bank with 95.46 million pesos. It can also be verified that the discussion of technology infrastructure and access controls was attributed to an executive in El Economista.

It is not confirmed in the material provided that the CNBV issued a new official rule with those requirements, or that there are sanctions or additional regulatory deadlines arising from those publications.