San Luis Potosí reports extortion after hack

Update September 8, 2026: The scope of the leak affecting San Luis Potosí City Hall is now clearer, with more than 15,000 documents tied to public officials’ 2022 asset and tax declarations. It was also added that the municipality ordered a complaint to be filed with the State Attorney General’s Office, and the capital city’s Cyber Police and the Department of Technological Innovation are taking part in the investigation.

San Luis Potosí City Hall suffered a hack, lost about 2.9 GB of data from its servers, and then received an extortion attempt to release the stolen files. Mayor Enrique Galindo Ceballos said there was no negotiation with the attackers and that the municipality has already filed a federal complaint.

What is known about the attack and the demand for payment?

The municipality publicly acknowledged the theft of roughly 2.9 GB of information, according to El Sol de San Luis, and later reported that the attackers tried to charge for the return or release of the material. Pulso reported that the mayor confirmed the extortion attempt after the municipal hack.

Ransomware.mx included the case in its intelligence report on August 26 and described it as a Mexican city hall under extortion pressure after an intrusion. Local coverage places the episode within a broader string of incidents in San Luis Potosí, where different public entities were exposed over a short period.

How far could the leak reach?

Local media say the compromised information may include around 15,000 asset declarations from municipal officials, based on an analysis of the leak attributed to the same actor that hit other agencies in the state. Plano Informativo expanded on that figure and said the leak may have involved about 2.9 GB of information and more than 15,000 documents tied to 2022 asset and tax declarations from public servants.

San Luis Hoy warned that the theft of 2.9 GB could expose personal data, private documents, public records, litigation files, probate proceedings, and information belonging to municipal workers. The same analysis says the exact scope of the hack is still unknown.

Even so, the mix of exposed files and the type of documents mentioned raises the sensitivity of the case for the local administration and for third parties who may appear in those records.

How did the municipality respond?

The city government activated internal cybersecurity protocols and tightened access controls, according to Código San Luis, alongside the formal complaint. Plano Informativo added that the municipality ordered a complaint to be filed with the State Attorney General’s Office and that the investigation includes the capital city’s Cyber Police, part of the Secretariat of Security and Citizen Protection, and the Department of Technological Innovation.

No specific technical measures have been detailed so far, and no particular vendor has been named in the response.

Galindo Ceballos also said the municipality did not negotiate with the attackers and chose to take the case to federal court. That matches Ransomware.mx’s assessment, which framed the episode as extortion after a hack against a local Mexican government.

What other institutions appear in the same wave of incidents?

Regional coverage linked the city hall attack to a chain of possible breaches in San Luis Potosí that also mentioned UASLP, the State Judiciary, and Cobach, all flagged for leaks or unauthorized access within less than two weeks. Pulso SLP also said the alleged hacker claims to have obtained databases from other local institutions and tried to negotiate or pressure several public entities.

In that same environment, Ground News summarized that municipal authorities are examining the possibility that the attackers used artificial intelligence tools to break into systems and extract information in bulk. Separately, War Room SLP reported that the San Luis Potosí Judiciary is weighing a change of IT provider and opening an internal investigation after documents were posted online and a hack is suspected.

What do recent reports say about extortion in SLP?

Criminal pressure through extortion remained high in the state during 2026. San Luis Potosí’s Secretariat of Security and Citizen Protection reported 98 extortion complaints in the first two months of the year, through the 911 and 089 hotlines, according to an information request cited by Astrolabio.

El Sol de San Luis reported the same volume for January and February, concentrated in the capital and in Soledad de Graciano Sánchez. In the first quarter, Quadratín Querétaro cited SESNSP figures and reported 37 extortion complaints in San Luis Potosí, compared with 33 in the same period of 2025.

Astrolabio, in another analysis, broke the year down into 6 complaints in January, 7 in February, and 16 in March 2026, for a total of 29 cases in the quarter. That number differs from the earlier figure and suggests different statistical cuts across sources.

Antena San Luis also said total criminal case files in the state fell from 14,610 in the first half of 2025 to 12,923 in the same period of 2026, although extortion was among the crimes rising. Quadratín San Luis Potosí, for its part, reported that extortion complaints rose more than 30% in the state capital at the start of 2026, especially through phone threats, protection rackets, and fraud targeting merchants and residents.

Plano Informativo, in a separate note on the issue, recommended saving audio and messages, not making payments, and reporting to 089 and 911. The outlet described extortion as a crime that quietly stalks people in San Luis Potosí and highlighted those channels as the preferred official routes.