Mexico Ranks Second in LATAM Ransomware Cases

Mexico has emerged in 2026 as one of the most active ransomware targets in Latin America. An EITMedia analysis, based on a report from an international security firm, places the country second in the region by number of victims, behind Brazil, in a half-year period when global attack volume rose 16.5%.

Which groups are operating in Mexico

Ransomware Response monitoring for Mexico shows the most active groups by recorded victims are LockBit 3.0, with 31 cases, Qilin with 20, LockBit5 with 12, Cl0p with 11 and RansomHub with 8. That snapshot matches other measurements pointing to sustained double-extortion activity in the country.

Ransomlook.io also shows recent posts on data leak sites attributed to LockBit, Akira and Qilin with victims in several Latin American countries, including Mexico, during June and July 2026. At the same time, BreachSense's July 2026 report places TheGentlemen and Qilin in the global No. 1 spot by number of listed victims, with 119 each, out of a total of 811 companies affected by 66 groups across 78 countries.

Computerworld España, using data from NCC Group and Comparitech, places Qilin and The Gentlemen in first and second place globally by number of attacks in the second quarter of 2026, while Akira, DragonForce and LockBit complete the top six. EITMedia adds that Qilin has 722 confirmed attacks in the half-year, The Gentlemen about 550 and Akira more than 300, figures that frame the activity seen in Mexico within broader campaigns.

Most exposed sectors

In the country, the sectors most affected by ransomware are Business Services, with 40 victims, Manufacturing with 30, Technology with 21, Public Sector with 19 and Healthcare with 14. The pattern puts business services and manufacturing at the top of the target list.

That focus matches Blackpoint Cyber's profile of The Gentlemen, which describes it as a RaaS operation that emerged in August 2025, specialized in double extortion and with a particular focus on the industrial and manufacturing sectors. The same source also says the most frequent victim headquarters regions include Asia and South America, which reinforces its presence in markets such as Mexico.

Veeam places Akira at 9% market share of observed variant payments in the second quarter of 2026 and The Gentlemen at 8%, confirming both as part of the core of the most profitable extortion operations globally.

Pressure on corporate defenses

The technical analysis cited by Computerworld España says The Gentlemen adopted a framework called GentleKiller, with variants that use vulnerable drivers and utilities to disable EDR tools and target a wide range of endpoint security products. That capability raises the chance of operational impact in organizations with advanced controls.

On the Ransomware.live map, Mexico shows more than 270 publicly identified victims through the end of July 2026. The figure exceeds the one mentioned in some regional reports and suggests prior estimates were undercounting, while also pointing to real exposure greater than the "almost 80" cases cited by other media.