Situación Nacional de Ciberseguridad - Junio 2026 - México

Monthly reference modules

These modules are completed automatically with verified facts and sources from the period. They are the recurring reading month after month; the later analysis develops the cases without repeating this summary.

Executive monthly summary for Mexico

June 2026 sent a clear signal in Mexico, the month was dominated by documented incidents, with 41 verified events, and by sustained ransomware and extortion pressure, which accounted for 17 cases. The picture is not one of an isolated event, but of a broad attack surface, with visible impact across finance, telecom, manufacturing, the public sector, and technology providers.

The financial sector was the clearest area for measuring damage. Banxico reported eight cyber incidents at institutions in the financial system through May 2026, double the total for all of 2025, and also identified ransomware families such as LockBit and Qilin in specific events. The technical readout of those cases shows a mixed pattern, with attacks that affected transfers, electronic channels, and, in some cases, the extraction of information hosted by third parties.

The month also showed a second layer of exposure, involving personal data and credentials. There were leaks tied to the cellular line registry, databases allegedly linked to education agencies, state environments, and fraudulent domains used in campaigns connected to the 2026 World Cup. In parallel, Nissan Americas confirmed a breach stemming from exploitation of Oracle PeopleSoft that reached operations in Mexico, exposing employee and former employee data.

On the active exploitation front, alerts centered on Cisco Catalyst SD-WAN, PostgreSQL Sidecar, FortiSandbox, and Microsoft Defender. Smartekh documented active campaigns against government entities in Mexico and described exploitation or recent abuse evidence in several high-risk CVEs. The overall picture is one of high tactical pressure, with adversaries combining ransomware, data leaks, supply chain abuse, and rapid use of newly disclosed vulnerabilities.

Mexico Country Intelligence for the Month

Mexico’s risk reading for June 2026 is high. Volume is heavy and severity is too, because this is not just a matter of more events, but of events with real capacity to disrupt financial services, extract sensitive information, apply extortion pressure, and force regulatory or technical responses in critical sectors. The combination of 41 documented incidents, 17 ransomware or extortion cases, 4 fraud or phishing cases, and 7 critical CVEs mentioned points to a month of sustained exposure.

The dominant trend was operational incidents, not rumors or abstract campaigns. There was evidence of compromise in banks, an industrial paper company, telecommunications, public agencies, and vendor environments. That suggests adversaries are still finding weak points both at the technology edge and inside systems that depend on third parties. The fact that 82 percent of the events have direct source confirmation reinforces the strength of the signal, although the available material also includes some uncertain references that require separating verified facts from claims that are not fully corroborated.

Mexico also faced an incomplete regulatory debate. Infobae reported that the country still lacks a fully implemented General Cybersecurity Law and a National CSIRT with robust capabilities, while the Executive Branch advanced a General Cybersecurity Policy for the Federal Public Administration. Added to that was the CRT requirement to link mobile phone lines to the CURP before June 30, a measure that affects digital identity and authentication processes in mass-market services.

In the regional context, the Mexican case ranks among the most active in Latin America for volume of pressure and for recurring ransomware. The country appears in journalistic and technical reports as one of the most targeted environments in the region, with a mix of opportunistic attacks, prepared campaigns, and exploitation of vulnerabilities in widely used components.

Mexico period indicators

Relevant Incidents in Mexico

Banxico and the Mexican Financial System

Banxico updated its technical report on cyber incidents in Mexico’s financial system in 2026, providing a concrete reference point for tracking how the problem has evolved. As of June 10, the central bank had documented eight incidents at financial institutions between January and May. Half of those cases involved two named ransomware strains, LockBit and Qilin, while the rest pointed to breaches affecting transfer services, electronic channels, or third-party applications.

The value of the report is not just the tally. It is also in the breakdown. The first event, in January, affected electronic transfers at a bank and was contained without losses. The second, in February, compromised channels and interbank payments and led to a loss of about 91.7 million pesos for the institution. In March and April, incidents appeared at a SOCAP and a Sofipo, confirming that pressure was not limited to traditional banking. In May, Banxico added a case at an IFPE and another bank with data exfiltrated from third parties, without affecting financial operations.

The technical reading is that the critical surface shifted between ransomware, third parties, and transaction services. There was no single dominant vector. There was a sequence of opportunities exploited by different actors or malware families, and that diversity makes response harder because it requires continuity controls, vendor monitoring, and channel integrity oversight. At the same time, public debate hardened around risks to transfers, payments, and digital services.

Mobile Phone Data Leak and Pressure on the CURP Registry

June also brought signs of mass exposure in the mobile telecom ecosystem. Infobae México reported that a leak attributed to hackers exposed data from 45,804 mobile users in Mexico, including names, phone numbers, and RFC. Coverage placed most of the case in Chiapas. Moncloa, meanwhile, reported about 45,000 records from the mobile subscriber registry, with Movistar affected and a connection to PANAUT.

The regulatory backdrop was immediate. The CRT reiterated that mobile lines had to be linked to a CURP by June 30, or they would be blocked. DPL News said that as of June 12, 59.167 million lines were linked out of 144 million total, leaving about 85 million still unregistered. In that climate, the leak gained operational relevance because a subscriber database intersects with authentication, account recovery, and commercial processes.

The episode was not isolated. At the same time, audiovisual and journalistic material circulated about a broader alleged leak of records tied to the same ecosystem, although some of that information was presented cautiously or as a theory about intermediaries. For the purposes of this report, the verifiable point is the confirmed exposure of tens of thousands of users and the fragility of the line registration scheme.

Copamex and DragonForce’s Public Threat

On June 3, DragonForce claimed to have attacked Copamex, described as a leading paper manufacturer in Mexico. The group threatened to publish sensitive data if its demands were not met. The source places the case in the industrial sector, specifically paper and manufacturing.

There is no independent confirmation in the available material of operational impact, but there is a public statement from the gang and an explicit threat to leak data. That format matters because it shows the pressure playbook, first the claim of compromise, then the warning of publication, then possible negotiation. In risk terms, Copamex falls into the same set of June cases where extortion and publicization of the attack are central parts of the harm.

Ford de Mexico and Krybit’s Pressure

On June 28, Krybit claimed to have compromised Ford Motor Company, S.A. de C.V., meaning Ford de Mexico. DeXpose logged the claim and the threat to publish sensitive information if there was no negotiation. A later analysis, on June 30, said the company had not publicly confirmed any breach and that the alleged volume and nature of the data remained unverified independently.

That leaves two separate tracks. On one, the threat actor claims intrusion and uses it as leverage. On the other, there is not enough public confirmation to treat the case as a validated breach. Even so, the episode belongs to the broader set of 17 ransomware or extortion cases documented in the month, because the threat of leaking data is already part of the coercive pattern observed in Mexico.

Nissan Americas and the Cross-Border Impact of Oracle PeopleSoft

Nissan Americas reported a breach tied to exploitation of CVE-2026-35273 in Oracle PeopleSoft. The scope included operations in the United States, Canada, Mexico, and Brazil, with exposure of employee and former employee data, including names, banking details, financial and tax files, and national identifiers. Devel Group specified that the official notice was issued on June 25.

Although the intrusion is not limited to Mexico, it directly affects personnel and processes in the country. The case matters for two reasons. First, it involves widely deployed enterprise software. Second, it exposed data that can support fraud, impersonation, or later social engineering campaigns. Operationally, it is a high-value breach for actors who monetize identity and credentials.

Campaigns Against Government and Vulnerability Exploitation

Smartekh reported active campaigns against government entities in Mexico and pointed to active exploitation of CVE-2026-20262 in Cisco Catalyst SD-WAN Manager. Cisco’s advisory also included CVE-2026-20245 and described prior exploitation paths in other vulnerabilities in the same platform. The report also mentioned limited exploitation of CVE-2026-20253 in PostgreSQL Sidecar and proof-of-concept testing for CVE-2026-50656, RoguePlanet, in Microsoft Defender.

The significance here is not just the CVE list. It is the context in which they are being used. There is campaign activity, observed exploitation, and interest in systems that can serve as pivot points inside administrative networks. The detail carries weight because it points to government and to digital infrastructure used in environments with sensitive operational continuity.

Brief Timeline of High-Impact Events