Mexico Govt, Monterrey Water Hit by AI Actor

An unidentified adversary used AI models including Anthropic’s Claude and OpenAI’s GPT in a large-scale intrusion against multiple Mexican government organizations between December 2025 and February 2026. According to the analysis cited by Cryptonomist, the attack led to the theft of large amounts of sensitive government data and civilian records.

What happened in Monterrey?

The same report, based on research from Dragos and Gambit Security, ties that activity to a related breach at a municipal water and drainage company serving the Monterrey metro area. There, an initial compromise of information technology in January 2026 escalated into an attempted breach of operational technology infrastructure, underscoring the convergence between corporate access and industrial systems.

Dragos said it found no overlap between this adversary and any previously tracked threat group. In that assessment, it was a new AI-assisted actor, with no specific attribution to a known APT or a state actor.

What does the regional context say?

The episode comes as Mexico also appears in an industry threat landscape report on the banking and insurance sector cited by Portafolio. That analysis says Latin America saw the world’s highest relative growth in cyberattacks against the financial sector in 2025.

Portafolio added that ransomware accounted for 79% of financial incidents in the region and that Brazil, Mexico, Argentina, Colombia, and Peru made up roughly half of the reported cases. The same material did not specify which of those events were APT attacks or state-linked activity.