Ransomware en México

An actor posting as cenfecracked claims to have obtained the database behind the Sistema de Atención Ciudadana, the platform through which members of the public submit petitions and requests for assistance to the Mexican Presidency.

Threat actors posting as homercracker and cenfecracked claim to have extracted the full contents of CADPE, the executive procurement and administrative platform of the Michoacán State Government in Mexico, which handles public tenders and supplier registration.

A threat actor using the alias derm0nix (Hackero$ Crew) claims to have breached the Portal de Salud de Culiacán, the official digital health system of the Culiacán municipal government in Mexico, and has leaked the data for free.

A threat actor using the alias Straightonumberone is selling what they describe as data stolen from Grupo ATC, a Mexican logistics conglomerate (comprising TLE, TLEA, and PHES), for $1,000 after a ransom negotiation reportedly failed.

A threat actor using the alias D3spair157 (operating as “Sociedad Privada 157”) has posted what they describe as a data leak from the Secretaría de Educación del Estado de Durango (SEED), Mexico's Durango state education department, reportedly obtained using administrator credentials to its student-management portal.

Threat actors using the aliases M1sery157 and D3spair157 (operating as “Sociedad privada 157”) have posted what they describe as a database scraped from a Coahuila state government portal in Mexico.

An actor posting as exfilar claims to have found an unsecured marketing database holding 148,251 Belgian consumer records, described as left accessible with no authentication and no encryption.

An actor posting as exfilar claims that two cloud storage buckets belonging to ABC-Map, a geospatial climate adaptation tool operated by the UN Food and Agriculture Organization and funded by the French Development Agency, are publicly accessible with no authentication and no access rules.

A group posting as ZeroBytes claims to have breached the French tax administration's public portal and is selling a partial database of 678,438 records dated to June 2026.

An actor posting as exfilar is selling three live production API keys for Branch, a mobile deep linking platform, which they say permit unlimited link creation on Branch's default shared link domain, bnc.lt.

An actor posting as exfilar is advertising what they describe as a complete dump of Gran Caribe Hotel Group, Cuba's largest state-owned tourism corporation, comprising 34 database backups totalling 110GB taken from production servers.

An actor posting as DarkMafiaX has published what they describe as the database of HerbaSis, a Brazilian business management platform used by independent nutrition consultants to track customers, orders, appointments, and wellness assessments.

A forum user posting as slvsh3r has published what they describe as the database and complete source code of HeyPulse, a French B2B marketing platform that runs prize-based games to help local businesses generate Google reviews and improve their visibility.

An actor posting as GordonFreeman claims to hold the complete database of RENAPER, Argentina's Registro Nacional de las Personas, the national authority responsible for citizen identity and the issuance of the DNI.

An actor posting as exfilar claims that ArtNexus, a Colombian fine art magazine and marketplace connecting galleries, collectors, and curators across 37 countries, left its backend database publicly readable with no authentication.

An actor posting as citizengod has published what they describe as the database and source code of the Schools Division of Iloilo, the local office of the Philippines' Department of Education, which administers schooling from kindergarten to senior high school.

Levi Strauss & Co. (the “Company”) recently detected that the Company experienced a cybersecurity incident in which an unauthorized third party gained access to Company files through social engineering techniques

An actor posting as Cybernox has published what they describe as user data from Bloctel, the French government's official register allowing consumers to opt out of unsolicited telephone marketing.

A forum user posting as 888 has published what they describe as a breach of ACRE Africa, an authorised insurance intermediary providing agricultural and climate risk cover to smallholder farmers across the continent.

A seller posting as weykofa is advertising what they describe as the database of the Fédération Française de Basketball, the national governing body for basketball in France.