Mexico: cybersecurity landscape, July 2026

Threats and active campaigns in Mexico

Ransomware and extortion with confirmed encryption

In July, at least four incidents with confirmed asset encryption appeared in the material reviewed. Among them, the Contacto Garantido case is the clearest. The section also includes other incidents where ransomware was described in more or less technical detail, although in several cases the material did not allow confirmation of the damage scale or the scope of the disruption.

The recurring pattern is abuse of exposed services, leaked credentials, misconfigurations, and access through the public-facing attack surface. The material does not show a clear predominance of CVE exploitation for ransomware against Mexico during the month, but rather hardening failures and poor perimeter management.

Ransomware and extortion, leak site mention only

Two cases remained in the leak site mention only category. They matter for monitoring, but they should not be confused with confirmed intrusion or proven encryption. The distinction is relevant because extortion groups often use leak sites as a pressure tool even when public evidence of compromise is incomplete.

In the July report, that situation appears especially in claims from groups such as Qilin and Krybit, where the strongest data point is the publication or reference on the actor’s portal. Without internal telemetry or a forensic finding, the material does not support a stronger conclusion.

Fraud and phishing in Mexico

Phishing gained both regulatory and operational weight. Mexico City classified phishing as an independent crime, and at the same time several reports described its mass use in banking scams. The press material explained the most common mechanism, messages by SMS, WhatsApp, or email that imitate a financial institution to push the victim away from the official app and steal credentials, PINs, or other access data.

The technical side and the legal side aligned in the same month. That does not mean the problem has been solved, but it does show that the institutional ecosystem better recognizes the specific harm caused by these scams. There was also coverage of impersonation of 11 financial institutions reported by CONDUSEF during June, a useful context point, although it is not counted as a July incident.

APT, AI-assisted intrusion, and opportunistic hacktivism

Although ransomware dominated the month, a separate technical line emerged tied to the use of AI in intrusions against Mexican government organizations and a water utility in Monterrey. Dragos and Gambit Security, cited by Cryptonomist, described the use of Claude and GPT to speed up reconnaissance, tool development, and exploitation, with automated password spraying attempts against an industrial gateway. There is no public evidence that the OT environment was breached, but the case showed a new form of offensive assistance.

In parallel, Proceso attributed a series of attacks against Sinaloa portals to Hackers$ Crew, and ransomware.mx reported several entries associated with the collective or with linked aliases. In the available material, the attribution remains more declarative than forensic, but the visibility of those names across multiple sources suggests sustained pressure on public portals and exposed databases.

Critical vulnerabilities with impact in Mexico

Regulation and compliance in Mexico

July was one of the busiest months for regulation. Mexico City made phishing an independent crime, with penalties of three to six years in prison and fines of 200 to 600 UMA, with harsher sanctions when the victim is a minor, an older adult, or a person with a disability. It signals a tougher criminal approach to digital fraud, and it could have practical effects on complaints and on how online scams are argued in court.

There were also advances and debates around digital identity and personal data. The Secretariat of Anti-Corruption and Good Governance announced a fine against the Mexican Football Federation for the handling of personal data through Fan ID, and it later emerged that the agency had set its first public criteria on data protection based on that case. At the same time, discussions continued on multi-biometric banking, liveness checks, facial recognition verification, and the use of official databases to validate identity in higher-risk transactions.

Banks came under greater regulatory scrutiny. Coverage focused on the CNBV, the ABM, and the move to e.firma in employer filings with the IMSS, along with the replacement of the NPIE certificate. There was also discussion of stricter documentation and cyber risk requirements under frameworks such as Basel IV. By July, the message was clear, cyber risk management was no longer just a technical issue, it had become an explicit part of operational compliance.

On AI, Mexico continued with a fragmented framework. There were federal debates, sector-specific initiatives, a repeal in San Luis Potosí, and multiple views on the absence of a general law. What can be verified for the month is that the country kept regulating in pieces, while political pressure grew for a more comprehensive rule.

Most affected sectors in Mexico

The public sector was the most visible in terms of reputational and operational impact, though not necessarily in absolute volume. León, Sinaloa and the Presidency drew public attention, with a mix of disruptions, information exposure and debate over attribution. When a leak includes registries, payroll records, medical files or citizen complaints, the potential damage goes beyond the affected system and reaches administrative processes, public trust and personal safety.

The financial sector was also prominent, but through a mix of fraud, biometrics, identity theft and regulation. Not everything was an intrusion. Several reports during the month showed pressure to tighten KYC, validate identity with biometrics and strengthen data handling. The fraud side remains critical, even if the incident category is not always formally recorded as a breach.

Manufacturing, business services and information technology kept appearing among the sectors with the most ransomware signals in open monitors. That matches the pattern from the previous month, although in July the publicity pressure and publication volume were higher. Health also reappeared, both in confirmed cases and in early warning material, and that means healthcare incidents should not be treated as isolated.

The sector reading, then, is not of a single front but of three layers. Government and public services for leaks and outages, finance for fraud and compliance, and industry and services for extortion and infrastructure exposure. The seven sectors with documented incidents show cross-cutting coverage, not a problem confined to one vertical.

Trends and signals to watch in Mexico

The month-over-month comparison shows a sharp acceleration across nearly every front that matters. Verified incidents rose from 56 to 105. Ransomware or extortion cases climbed from 15 to 55. Documented fraud and phishing increased from 2 to 7. Critical CVEs mentioned jumped from 4 to 19. Only the number of sectors with documented incidents stayed flat at 7.

That points to a denser risk agenda, not necessarily a more orderly one. Last month already showed signs of extortion, but in July the publications multiplied and more cases included technical detail. At the same time, regulatory pressure increased on banking, biometrics, and digital fraud. For security and compliance teams, the overlap between incident, regulation, and reputation became tighter.

There are three signals worth following closely. The first is whether public ransomware cases continue shifting from simple listings on leak sites to confirmed encryption or leaks with demonstrable impact. The second is whether public portals and citizen service systems keep exposing logic flaws, such as the SIDAC IDOR, beyond classic infrastructure issues. The third is whether active exploitation of critical CVEs turns into local incidents, especially in collaboration software, identity systems, remote gateways, and exposed platforms.

The regional comparison also remains tense. This month’s sources insist that Mexico remains among the most attacked countries in Latin America, although that sits alongside the methodological reminder that many figures disclosed by vendors are telemetry or attempts, not confirmed incidents. The useful signal is not just the count, but the persistence of the same vectors: exposed services, phishing, identity abuse, and configuration flaws.

Security recommendations for teams in Mexico

First, focus on exposure management. Several incidents this month showed that initial access did not come from a sophisticated chain, but from misconfigured MSSQL, exposed credentials, unpatched edge services, and weak logical access. That calls for reviewing inventory, external exposure, and configuration posture before moving on to more advanced controls.

Second, harden identity and access controls. This month made clear that identity is the central vector, from banking phishing and impersonation to banking biometrics, e.signature, access to citizen systems, and leaks of sensitive data. Strong MFA, anomaly monitoring, privilege review, and validation of access flows should be a priority, especially in service portals and back offices with sensitive information.

Third, segment critical environments more effectively. Cases tied to healthcare, citizen services, and operational technology show that a breach in IT can escalate into OT, or that a leak in a portal can lead to amplified impact. Separating networks, limiting trust between domains, and reviewing print queues, repositories, and industrial gateways helps reduce the blast radius.

Fourth, prepare legal and reputational response. In July there were incidents where it was not clear whether encryption had been used, but there was public exposure, information funneling, and pressure from a leak site. When that happens, the security team needs to work with legal, privacy, and communications from the first hour. The difference between a leak and a takedown can be blurry for the public, not for the regulator.

Fifth, treat active CVE exploitation as an action list, not an appendix. With 19 critical vulnerabilities mentioned, several already exploited in the wild, patch timing cannot depend on the normal maintenance cycle. Products exposed to the internet, federated authentication, collaboration tools, and remote gateways need explicit priority.

Material limitations

This report was built exclusively from the material provided for Mexico in July 2026. The time window covered by the indicators includes 108 dated events in July 2026, plus 1 earlier event used only as a comparative frame, and excludes 2 events after the period. No external information or internet sources were used.

An indicator at 0, or a lack of detail, does not mean the event did not exist in the region or the country. In particular, if a CVE or a category does not appear as monthly volume, that only means it was not recorded in the material analyzed under this window and these criteria. It should not be interpreted as a lack of vulnerabilities, attacks, or real-world exploitation.

The ransomware and extortion taxonomy also has methodological limits. In several cases, the material only mentions a victim on a leak site or an actor claim, without making it possible to determine whether there was encryption, exfiltration, or both. When the source did not make that clear, the classification was kept as not determinable.

Aggregate telemetry figures, attempts, blocks, and weekly vendor averages were left out of the count. Events without confirmed dates and any reference not within the available sources to cite were also excluded. Consumer social media, sponsored content, and promotional material were not used as evidence for trends, unless the open source provided a verifiable datum that could be independently attributed.

Comparative modules and monthly figures should be read as a snapshot of the period, not as a complete series of Mexican risk. Where a note provided regional or sector context, it was used for interpretation and not to invent additional incidents. If a source referred to attempts, blocks, or scans, it was treated as telemetry and not as an incident with confirmed impact.