Mexico: cybersecurity landscape, June 2026

Relevant incidents in Mexico

Unauthorized access to data from La Escuela es Nuestra

The most concrete development at the start of the month was the unauthorized access to information from some school committees in the federal La Escuela es Nuestra program. The Digital Transformation and Telecommunications Agency said the access occurred using compromised username and password credentials and that there was no direct hack of the platform. That distinction matters because it shifts attention away from a system flaw and toward stolen identity abuse, a pattern that often has less visible but equally serious consequences for data protection.

The source does not describe a service disruption, but it does confirm exposure of public and administrative information. For a government entity, that kind of incident leaves a simple lesson: access control and credential hygiene are just as critical as the application layer.

Financial attacks confirmed by Banxico

During June, the picture of a financial system hit by successive incidents became clearer. Banxico reported, through its Financial Stability Report cited by several outlets, that as of May 2026 eight cyber incidents had been recorded at Mexican financial institutions, compared with four in all of 2025. Coverage also detailed that the first incident of the year was a Lockbit ransomware attack against a bank in January, with a temporary impact on electronic transfers.

What makes this block relevant is not just the aggregate figure, but the institutional spread. The reported cases involved banks, Sofipos, a Socap and an electronic payment fund institution. That suggests the risk is not limited to traditional banking and that exposure extends to nonbank players in the financial ecosystem, where response capabilities can vary widely.

Exposure of federal and state agencies

The month kept alive coverage of campaigns that, according to multiple sources, affected Mexican government agencies. The best documented case from a technical standpoint is the one reconstructed by Gambit Security, which described a single-actor operation that used Claude Code and GPT-4.1 together to compromise nine Mexican government organizations and exfiltrate about 150 GB of data, with massive identity exposure. The material went beyond the headline and showed an automated exploitation chain, stolen-data analysis and the production of reports ready for operational use.

Along the same lines, other reports mentioned alleged intrusions attributed to EsqueleSquad against nine federal agencies and a broader campaign that reached public bodies, although not all cases could be classified precisely. For the purposes of this report, the relevant point is that the public sector continued to appear as a priority exfiltration target, with taxpayer data, registries and credentials at stake.

Ransomware at Copamex, Idefeey Yucatán, Ford de México and other cases

June brought multiple references to ransomware or extortion, with varying levels of confirmation. Copamex appears with an incident disclosed in RecentBreaches coverage as ransomware attributed to DragonForce, with exposure of corporate files and confidential documents. On the domain idefeey.yucatan.gob.mx, tied to educational infrastructure in Yucatán, a LockBit5 case involving data theft and encryption was confirmed, dated June 17 and publicly discovered on June 20.

There were also mentions of Ford de México and extortion attempts against other companies, but in those cases the exact classification was less clear or depended only on their appearance on leak sites. The month should therefore be read carefully: several names circulated, but only part of the activity allowed for a distinction between encryption, exfiltration without encryption, or a mere claim on a leak site. That difference is not semantic, it changes the reading of the operational damage completely.

Threats and Active Campaigns in Mexico

Ransomware and extortion in Mexico, with varying levels of confirmation

Confirmed asset encryption

Two events this month support a confirmed encryption finding. The first is the case of idefeey.yucatan.gob.mx, where Hookphish classified the incident as ransomware with data theft, and RecentBreaches reported that internal files were exfiltrated. The second is the attack on Copamex, where coverage itself states that corporate files and confidential documents were exposed, attributed to DragonForce. In both cases, the available material supports impact beyond a mere public threat.

Exfiltration without encryption, or simple extortion

The material also showed cases where the pressure centered on publishing data, without sufficient evidence of encryption. In June, at least two such cases were mentioned in the consolidated file, but the public information did not always make it possible to identify the exact technical scope. This matters in a monthly read because simple extortion usually leaves more traces of data exposure than of operational downtime, and it calls for defenses different from those used against classic ransomware.

Mention only on a leak site

There were also victims named on leak sites, such as ford.mx, where the Krybit group claimed to have obtained internal files and threatened to publish more data if there was no negotiation. The issue is that, at that level, the claim does not by itself amount to a verified intrusion and does not clarify whether encryption, exfiltration, or both occurred. For that reason, the source should be read as a threat signal, not as full proof of impact.

Fraud and phishing in Mexico

Mass fraud tied to the 2026 World Cup was one of the few clear signals outside ransomware. El Financiero reported that Mexico leads cyberfraud linked to the event because of the spread of fake ticket sales sites and bogus pages associated with FIFA. Infobae added that the campaign spans 18 states and that the phenomenon combines commercial deception, identity spoofing, and fraudulent domains.

There were also references to a leak of 45,804 mobile users, attributed to Mago Peak, and to the rise in digital crime reports received by the Mexico City Cyber Police. In both cases the pattern is similar, the fraud surface is built on reusable personal data and very specific contact channels, such as messaging or registration portals.

APT, targeted intrusion, and hacktivism in Mexico

Operation Escaneo deserves a separate mention because it does not fit the mold of opportunistic ransomware or commercial fraud. CloudSEK described it as an active reconnaissance and exploitation campaign against Mexico, using tools such as Neo-reGeorg, Chisel, and compromised Cisco routers to maintain persistent access. Infosecurity Magazine placed it across government, tax, utilities, transportation, telecommunications, and banks. The main signal here is intent to persist and map networks, not public extortion.

The case of AI-assisted attacks on Mexican agencies also points to a more sophisticated intrusion than average. Gambit Security's documentation shows an automated workflow in which AI is not a decorative layer, but part of reconnaissance, exploitation, and exploitation of the information obtained. There is no evidence of a single responsible group across all the month's public cases, but there is evidence of convergence between offensive automation and high-value targets.

Critical vulnerabilities affecting Mexico

The month’s technical focus centered on exposed software and widely used components. There was no single dominant product, but rather a cluster of critical flaws in tools that often sit at perimeters, remote support services, or content managers. That combination is especially sensitive for Mexico because the exposed surface spans public institutions, private companies, and service providers.

References also appeared to vulnerabilities exploited in Fortinet and Ivanti campaigns within Operation Escaneo, although the material collected does not always clearly separate which Mexican environments were actually affected and which were only potential targets. In these cases, the table should be read as a list of verified exposure, not as a complete inventory of every product at risk in the country.

Regulation and compliance in Mexico

June brought four documented regulatory moves, with a focus on privacy, digital identity, and financial cybersecurity. The most concrete was the CNBV's new circular for fintechs and SOFOMs that issue credit through digital channels. According to CreditoLab, the rule sets minimum cybersecurity standards, requires MFA, shortens incident reporting deadlines, and obligates firms to notify affected users when sensitive financial information involving more than 5,000 users is compromised. The reference source is secondary coverage, but the regulatory action itself is clearly defined.

At the same time, the Supreme Court ruled unconstitutional local provisions that required certain personal data to be included in certified copies of birth certificates. A provisional suspension was also reported so that a telecom company cannot require biometric data during line registration, and the Semanario Judicial published new criteria on privacy in the context of the biometric CURP. These are separate decisions, but they point in the same direction, greater caution around the expansion of sensitive identifiers.

The legislative debate also moved forward. On June 29, federal deputies presented a bill to create a General Law for the Regulation and Ethical Use of Artificial Intelligence in Mexico. The proposal aims to organize the development, application, and oversight of automated systems, with attention to algorithmic discrimination and privacy intrusion. From a public policy standpoint, the month sent a clear message, the regulatory discussion is no longer at the diagnostic stage, but at the stage of defining obligations.

Most affected sectors in Mexico

June’s sector pattern was broader than the ransomware label alone suggests. Finance led the volume of signals, with eight incidents cited by Banxico and a high density of coverage around transfers, losses, and systemic risk. Government made up the second major block, with unauthorized access, data exfiltration, and campaigns directed at federal and state agencies. The private sector was not spared, but its exposure was more fragmented across companies such as Copamex, Ford de México, and entities in the food, paper, packaging, and manufacturing ecosystem.

Manufacturing deserves separate attention. Although not every individual case in the month names it directly, the context material places it among the most targeted sectors in Mexico, which fits the presence of Copamex, Ford, and other references to industrial infrastructure. The issue is not only system availability, but operational continuity, the confidentiality of designs, and commercial pressure from data leakage.

One relevant feature is that several events cut across more than one sector at the same time. The idefeey.yucatan.gob.mx case involves the public sector, education, and state infrastructure. Operation Escaneo reaches government, finance, telecommunications, and utilities. For that reason, any sector reading has to be cautious and avoid treating coverage as exclusive when it is not. The real signal for the month is cross-cutting, but with greater intensity in finance, public administration, and environments where perimeter exposure remains high.

Trends and signals to watch in Mexico

There is no month-over-month baseline, because this is the first archived period with this indicator format for Mexico. That gap means numerical comparisons should be avoided. What can be said is that June cemented a pattern: ransomware and extortion dominated the conversation, while critical vulnerabilities and targeted intrusion campaigns gained visibility.

The main signal to watch in July is twofold. First, whether leak site threats and simple extortion materialize, especially at industrial companies and in the nonbank financial ecosystem. Second, how organizations respond to critical flaws already in KEV or marked as exploited, because risk depends not only on the existence of the CVE but on the real time it takes Mexican organizations to remediate. If that lag continues, the next month will likely keep showing incidents tied to known entry points rather than technical innovation.

The regulatory front also bears watching. The CNBV has already raised the bar for fintech and SOFOM, and the debate over biometric CURP, privacy and digital identification could accelerate new obligations. At the same time, the fraud campaign tied to the World Cup and the use of AI to automate reconnaissance and exploitation show that the line between classic cybercrime and AI-assisted operations is getting harder to distinguish.

Security recommendations for teams in Mexico

1. Review external exposure of appliances, content management systems, and remote support software, with priority on Fortinet, Ivanti, Cisco, Splunk, Joomla and SimpleHelp.
2. Tighten credential controls, especially in public programs, fintech and services with delegated access, because the case of La Escuela es Nuestra showed that one compromised credential can be enough.
3. Speed up patching and mitigations for assets marked as exploited or in active use during the month, and record the internal remediation date for audit purposes.
4. Separate ransomware response, exfiltration and simple extortion, because the negotiation content, system isolation and legal notification are not the same.
5. Review phishing and brand impersonation detection processes, especially campaigns tied to mass events, ticketing and spoofed pages.
6. In financial institutions, strengthen traceability for electronic transfers, third-party inventory and privilege segregation across digital channels.
7. In government and education, prioritize service account inventory, secret rotation, session validation and monitoring for anomalous access from valid credentials.
8. For organizations with an industrial footprint, verify operational continuity and offline backups, because pressure on manufacturing combines with extortion and leakage of technical data.

Material limitations

This report was prepared exclusively from the material provided for Mexico in June 2026. The indicator window includes 70 dated facts from June 2026, 4 facts from previous months used only as comparative context, 1 undated fact that was excluded from the indicators, and 2 facts after the period, also excluded. The period indicators reflect only facts dated within June and not aggregated telemetry of attempts or blocks.

A zero indicator does not mean that something did not occur in Mexico or the region, only that it did not appear in the analyzed material with the quality required for this report. This is especially true for CVEs, although this month there were four critical vulnerabilities mentioned. If in another period any category were to appear as zero, the meaning would remain the same, absence of a record in the corpus, not absence of a real phenomenon.

The distinction between incidents, telemetry, and attributed campaigns was maintained strictly. Attempt or block counts, such as those cited by vendors or coverage referring to massive attack volumes, were not counted as incidents with confirmed impact. They were also not used on their own to infer trend.

Consumer social networks and sponsored posts or press releases that were not included in the source list were excluded as evidence. When any coverage cited third-party material, the source that described the event most precisely was prioritized and, if the material did not allow impact to be confirmed, it was recorded as attributed or undetermined, as appropriate.