Mexico logs 60 critical ransomware victims

Entel Digital identified 60 critical infrastructure organizations in Mexico as ransomware victims between Jan. 1, 2025 and Sept. 21, 2026, according to a report cited by El Economista. The figure was built from posts on leak sites, lacks independent confirmation for each case, and is therefore likely to be undercounted.

What did the regional report show?

The regional tracking cited by El Economista placed TheGentlemen at 26 critical infrastructure victims in 2026 through the September cutoff, and Qilin at 25. Those figures cover Latin America as a whole and do not identify specific Mexican victims.

The reference helps show the scale of both groups in the region, but it does not allow those claims to be attributed to companies or entities in Mexico. In the material available, the regional series serves as context for the Entel Digital report, not as a country-by-country list of verified incidents.

What is known about the Grupo Euro Corporativo case?

Ransomware.mx reported that Krybit added Grupo Euro Corporativo, a business conglomerate in San Luis Potosí classified in manufacturing, to its victim list. The post did not provide independent confirmation of the incident or technical details on the group’s tactics, techniques, and procedures.

Ransomware.live indexed grupoeuro.com.mx as a victim claimed by Krybit and listed Oct. 24, 2026 as the estimated attack date. The record also showed exposure indicators attributed to HudsonRock and ParanoidLab, but it did not establish that those data came from the ransomware incident or confirm a breach.

Brandefense included grupoeuro.com.mx among the victims listed by Krybit, with Mexico as the country, manufacturing as the sector, and unspecified data said to have been compromised. HookPhish repeated the claim and said the organization had not issued independent confirmation, while RecentBreaches said Grupo Euro Corporativo had not confirmed the claim and had not publicly observed the files said to have been stolen.

The available material points to a common pattern: several monitoring sites repeated the claim against Grupo Euro Corporativo, but no independent validation of the incident appears in the sources reviewed, and no original technical evidence is cited. TTPs, the volume of compromised data, and operational impact are also not documented.