Mexico logs 60 critical ransomware victims

Update November 3, 2026: the tracking added new claims attributed to Qilin, Rhysida, SafePay and The Gentlemen against Mexican organizations. It also incorporated one additional victim claimed by Krybit, along with more monitoring corroboration for some Qilin posts, without validating the intrusion.

Entel Digital recorded 60 critical infrastructure organizations in Mexico as ransomware victims between Jan. 1, 2025 and Sept. 21, 2026, according to a report cited by El Economista. The figure was built from posts on leak sites, was not independently confirmed case by case, and is therefore subject to undercounting.

What did the regional report show?

The regional tracking cited by El Economista placed TheGentlemen at 26 critical infrastructure victims in 2026 through the September cutoff, and Qilin at 25. Those figures cover Latin America as a whole and do not identify specific Mexican victims.

The reference helps frame the scale of both groups in the region, but it does not allow those claims to be tied to companies or entities in Mexico. In the material available, the regional series serves as context for Entel Digital's report, not as a country-by-country list of verified incidents.

What new claims appeared in Mexico?

Ransomware.mx added four specific Qilin claims against Farmacia I, Innoe Asesores, Grupo Ciosa SAPI de CV and Sistemas Visuales 360, along with posts from Rhysida, SafePay and The Gentlemen about other Mexican organizations. In every case, the source presents them as group claims, without independent verification of the incident.

A Ransomware.mx post dated Oct. 31, 2026 also said Rhysida claimed to hold HR records from a paper company in Puebla, including alleged CURP, RFC and IMSS numbers. SafePay claimed the domain of the Autonomous University of Aguascalientes, and The Gentlemen added a sanitation company in Mexico City to its victim list.

What do the trackers and aggregate counts add?

ScrutEx said Qilin posted seven Mexican victims in the period analyzed and The Gentlemen posted two, in addition to one Mexican victim each attributed to Rhysida, SafePay, DireWolf, Emperador and LockBit. That count adds context on observed activity, but it does not identify all victims or confirm intrusions on its own.

SecurityArsenal logged four Mexican Qilin posts, including Sistemas Visuales 360, Farmacia I, Grupo Ciosa SAPI de CV and Innoe Asesores, and said its crawler corroborated the existence of the posts, but not an intrusion or data compromise. HookPhish described Innoe Asesores and Sistemas Visuales 360 as Qilin victims, though it did not provide a company statement, indicators of compromise, TTPs or verifiable data on the scope.

Ransomware.live indexed Grupo Ciosa, SAPI de CV as a victim claimed by Qilin and showed figures of five employees and 206 compromised users. Those numbers are part of the monitoring database and are not backed by company confirmation or independent technical evidence.

What is known about the Grupo Euro Corporativo case?

Ransomware.mx reported that Krybit added Grupo Euro Corporativo, a business conglomerate in San Luis Potosí classified under manufacturing, to its victim list. The post did not provide independent confirmation of the incident or technical details on the group's tactics, techniques and procedures.

Ransomware.live indexed grupoeuro.com.mx as a victim claimed by Krybit and listed Oct. 24, 2026 as the estimated attack date. The entry also showed exposure indicators attributed to HudsonRock and ParanoidLab, but it did not establish that those data came from the ransomware incident or confirm a breach.

Brandefense included grupoeuro.com.mx among the victims listed by Krybit, with Mexico as the country, manufacturing as the sector and unspecified data allegedly compromised. HookPhish repeated the claim and said the organization had not issued an independent confirmation, while RecentBreaches said Grupo Euro Corporativo had not confirmed the claim and that it had not publicly observed the allegedly stolen files.

The available material points to a common pattern: multiple tracking sites repeated claims against Mexican organizations, but no independent validation of the incidents or original technical evidence appears in the sources reviewed. TTPs, the volume of compromised information and operational impact were not documented either.