San Luis Potosí City Hall reports extortion after hack

San Luis Potosí City Hall suffered a hack that led to the theft of about 2.9 GB of data from its servers, followed by an extortion attempt to force the release of the stolen information. Mayor Enrique Galindo Ceballos said the municipality did not negotiate with the attackers and has already filed a federal complaint.

What is known about the attack and the attempted payment?

The municipality publicly acknowledged the theft of about 2.9 GB of information, according to El Sol de San Luis, and later reported that the attackers tried to charge for the return or release of the material. Pulso said the mayor confirmed the financial extortion attempt after the municipal hack.

Ransomware.mx included the case in its intelligence report on August 26 and described it as a Mexican city government under extortion pressure after an intrusion. Local coverage places the episode within a broader wave of incidents in San Luis Potosí, where different public entities were exposed over a short period.

How far could the leak reach?

Local media say the compromised material may include around 15,000 asset declarations from municipal officials, based on an analysis of the leak attributed to the same actor who breached other agencies in San Luis Potosí. San Luis Hoy warned that the 2.9 GB theft could expose personal data, private documents, public-record materials, litigation files, estate cases, and information about municipal employees.

That same analysis says the full scope of the hack is still unknown. Even so, the mix of exposed files and the types of documents mentioned increases the sensitivity of the case for the local administration and for third parties who may appear in those records.

How did the municipality respond?

The City Hall activated internal cybersecurity protocols and tightened access controls, according to Código San Luis, alongside the formal complaint. No specific technical measures have been detailed so far, and no single vendor has been named in the response.

Galindo Ceballos also said the municipality did not negotiate with the attackers and chose to take the case to federal court. That account matches Ransomware.mx, which framed the incident as extortion following a hack against a local Mexican government.

What other institutions appear in the same wave of incidents?

Regional coverage linked the City Hall attack to a string of possible breaches in San Luis Potosí that also mentioned UASLP, the State Judicial Branch, and Cobach, all identified in connection with leaks or unauthorized access in less than two weeks. Pulso SLP also said the alleged hacker claims to have obtained databases from other local institutions and tried to negotiate with, or pressure, several public entities.

In that same environment, Ground News said municipal authorities are weighing the possibility that the attackers used artificial intelligence tools to breach systems and extract information in bulk. Separately, War Room SLP reported that the San Luis Potosí Judicial Branch is considering changing IT providers and opening an internal investigation after documents were published online and a hack was suspected.