Mexico Cyber Watch
Reports since 1 Jan 2026. Not a live feed.
Threat level, Mexico
Background readingHacktivismIncident response
No public level found
No published national cyber threat level found for Mexico, checked 7 Nov 2026. Mexico publishes no national cyber threat level, and no single agency issues public national cyber alerts.
Source: ATDT
From official agencies
| Date | Agency | Advisory or alert |
|---|
Agency headlines, unedited.
Compare countries
| Country | Threat level | Confirmed | Claimed only | Via a vendor | Latest report |
|---|---|---|---|---|---|
 Malaysia | Medium | 19 | 35 | 7 | 7 Nov 2026 |
 Singapore | None published | 12 | 24 | 3 | 7 Nov 2026 |
 Indonesia | None published | 6 | 32 | 0 | 5 Nov 2026 |
 Thailand | None published | 9 | 33 | 0 | 3 Nov 2026 |
 Philippines | None published | 9 | 35 | 4 | 7 Nov 2026 |
 Vietnam | None published | 5 | 34 | 0 | 5 Nov 2026 |
 Israel | None published | 4 | 2 | 0 | 7 Nov 2026 |
 Iran | None published | 4 | 0 | 0 | 13 Jun 2026 |
 United Arab Emirates | None published | 4 | 4 | 1 | 7 Oct 2026 |
 Saudi Arabia | None published | 2 | 5 | 0 | 12 Oct 2026 |
 Egypt | None published | 1 | 4 | 1 | 29 Oct 2026 |
 South Africa | None published | 8 | 0 | 1 | 26 Oct 2026 |
 Nigeria | None published | 2 | 3 | 0 | 8 Aug 2026 |
 Kenya | None published | 1 | 6 | 0 | 25 Jul 2026 |
 India | None published | 9 | 2 | 1 | 28 Oct 2026 |
 Pakistan | None published | 3 | 3 | 0 | 22 Jul 2026 |
 Bangladesh | None published | 1 | 5 | 0 | 23 Oct 2026 |
 Sri Lanka | None published | 4 | 3 | 1 | 1 Jul 2026 |
 Cambodia | None published | 0 | 3 | 0 | 10 Jun 2026 |
 Myanmar | None published | 1 | 5 | 0 | 25 Oct 2026 |
 Brunei | None published | 0 | 0 | 0 | |
 Poland | BRAVO-CRP | 5 | 0 | 4 | 1 Oct 2026 |
 Ukraine | None published | 7 | 0 | 1 | 4 Nov 2026 |
 Russia | None published | 7 | 0 | 1 | 1 Nov 2026 |
 Czechia | None published | 3 | 0 | 1 | 22 Oct 2026 |
 Romania | None published | 2 | 0 | 0 | 14 Jul 2026 |
 Estonia | None published | 5 | 0 | 3 | 4 Nov 2026 |
 Turkey | None published | 3 | 0 | 1 | 16 Sep 2026 |
 United Kingdom | None published | 5 | 1 | 3 | 2 Nov 2026 |
 Germany | None published | 4 | 0 | 1 | 2 Nov 2026 |
 France | None published | 7 | 0 | 2 | 4 Nov 2026 |
 Netherlands | None published | 5 | 1 | 1 | 2 Nov 2026 |
 Italy | None published | 5 | 0 | 0 | 7 Nov 2026 |
 Spain | None published | 3 | 0 | 0 | 5 Feb 2026 |
 Ireland | None published | 3 | 4 | 0 | 2 Nov 2026 |
 Sweden | None published | 5 | 3 | 2 | 2 Nov 2026 |
 United States | None published | 6 | 0 | 2 | 28 Aug 2026 |
 Canada | None published | 5 | 0 | 1 | 21 Aug 2026 |
| Mexico | None published | 2 | 4 | 1 | 21 Aug 2026 |
 Brazil | None published | 2 | 2 | 0 | 2 Nov 2026 |
 Argentina | None published | 1 | 2 | 0 | 4 Aug 2026 |
 Chile | None published | 1 | 2 | 0 | 2 Nov 2026 |
 Colombia | None published | 1 | 2 | 0 | 4 Nov 2026 |
 Japan | None published | 9 | 0 | 5 | 4 Nov 2026 |
 South Korea | Caution | 6 | 0 | 2 | 29 Oct 2026 |
 China | None published | 0 | 3 | 0 | 7 Aug 2026 |
 Taiwan | None published | 9 | 0 | 2 | 3 Nov 2026 |
 Hong Kong | None published | 3 | 0 | 3 | 30 Oct 2026 |
 Australia | None published | 5 | 0 | 1 | 2 Nov 2026 |
 New Zealand | None published | 7 | 2 | 1 | 3 Sep 2026 |
2026 counts. Click a row to open a country.
Official numbers
| Measure | Value | Period | Source |
|---|
Who is targeting it
| Group | Kind | What it did | Sources | Reports |
|---|---|---|---|---|
| Qilin | Ransomware | The most frequent group on leak-site posts naming Mexican victims in 2026. | ransomware.live | Profile |
| The Gentlemen | Ransomware | Posted many Mexican manufacturing, retail and hospitality victims through 2026. | ransomware.live | Profile |
Laws and rules this year
Full stories
Official statements
Incidents
7 of 7 incidents
| What happened | Sources | |||||
|---|---|---|---|---|---|---|
 ⚠️ ClaimedCinépolis | 21 Aug 2026 | Other | Ransomware | Claimed. Qilin listed the cinema chain on its leak site. | ransomware.live✓ 7 Nov | |
 ⚠️ ClaimedSears México (Grupo Sanborns) | 15 Aug 2026 | Retail | Ransomware | Claimed. SpaceBears listed Sears México on its leak site and promised sample files ahead of a full release. No company statement found. | ransomware.live✓ 8 Nov | |
 ⚠️ ClaimedMunicipio de Chihuahua | 7 Feb 2026 | Government | Ransomware | Claimed. Qilin listed the Chihuahua municipal government on its leak site. | ransomware.live✓ 7 Nov | |
| 🚫 DisputedIMSS-Bienestar and other public bodiesVia a vendor | 30 Jan 2026 | Government | Data leak | Response. The Digital Transformation Agency (ATDT) said valid usernames and passwords found during the incident were disabled. It said it detected no breach of federal infrastructure and that old systems run by private vendors for states were mainly affected. Claimed. Chronus said it leaked 2.3 TB from about 25 institutions, including 1.8 TB from the IMSS-Bienestar register. | Infobae✓ 8 Nov | |
 ✅ ConfirmedTelcel | 12 Jan 2026 | Telecom | Data leak | None | Confirmed. Telcel said it found and fixed a technical vulnerability in its new line registration portal. It denied a mass data breach. Claimed. Users reported that entering any Telcel number returned the holder's name, CURP, birth date and email. | La Crónica de Hoy · Expansión✓ 8 Nov |
 ✅ ConfirmedUNAM | 7 Jan 2026 | Education | Intrusion | Confirmed. UNAM confirmed an unauthorised intrusion into 5 of its roughly 100,000 systems over the holidays. It disabled them and said there was no sign that student or staff personal data was extracted. Claimed. A journalist reported the attacker, ByteToBreach, reached data on over 380,000 students and staff and confidential rector's office mail. | El Financiero · Xataka✓ 8 Nov | |
 ⚠️ ClaimedFarmacia San Pablo | 2 Jan 2026 | Retail | Ransomware | Claimed. Qilin listed the pharmacy chain on its leak site with no proof attached. No company statement found. | Botcrawl✓ 8 Nov |
FAQ
Does Mexico have a national cyber threat level?
No published national cyber threat level was found for Mexico (checked 7 Nov 2026). Mexico publishes no national cyber threat level, and no single agency issues public national cyber alerts.
Which organisations in Mexico confirmed cyber incidents recently?
2 incidents confirmed since January 2026: Telcel and UNAM.
Which Mexico organisations appear on ransomware or leak sites?
5 claims, not confirmed by the organisations: Cinépolis, Sears México (Grupo Sanborns), Municipio de Chihuahua, IMSS-Bienestar and other public bodies and Farmacia San Pablo.
What counts as a confirmed incident?
The organisation, a regulator, the police or a minister has said something happened, as reported by a named outlet. Everything else is listed as claimed.
Why list leak-site claims at all?
Ransomware and extortion crews post victims on leak sites before anyone confirms. The list shows what attackers say. Treat it as a lead and check with the organisation.
Is the map a live attack feed?
No. It counts incidents and claims reported in 2026. Live attack maps from security vendors show scanning traffic hitting their sensors, which does not mean a place was attacked.
How often is it updated?
By hand when a national level changes or a notable incident is reported. The date is shown in the header.
Sources: official statements and regional press, including Bernama, The Star, Malay Mail, CNN Indonesia and Newsbytes.PH; leak-site claims from public ransomware trackers. Each entry links its source.