Ransomware en México

A threat actor using the alias derm0nix (Hackero$ Crew) claims to have breached the Portal de Salud de Culiacán, the official digital health system of the Culiacán municipal government in Mexico, and has leaked the data for free.

A threat actor using the alias Straightonumberone is selling what they describe as data stolen from Grupo ATC, a Mexican logistics conglomerate (comprising TLE, TLEA, and PHES), for $1,000 after a ransom negotiation reportedly failed.

A threat actor using the alias D3spair157 (operating as “Sociedad Privada 157”) has posted what they describe as a data leak from the Secretaría de Educación del Estado de Durango (SEED), Mexico's Durango state education department, reportedly obtained using administrator credentials to its student-management portal.

Threat actors using the aliases M1sery157 and D3spair157 (operating as “Sociedad privada 157”) have posted what they describe as a database scraped from a Coahuila state government portal in Mexico.

Ransomware Attack Update - July 11th, 2026

Dutch police say they have uncovered strong indications that local criminals were involved in the cyberattack against telecommunications provider Odido, which exposed personal information belonging to millions of customers.

A threat actor using the alias ChimeraZ claims to be leaking a database from the seller portal of Bebeboutik (sales.bebeboutik.fr), a French private-sales marketplace for baby and children's products.

A threat actor using the alias 84City has posted an SQL dump they attribute to PPA Business School, described as one of the largest private higher-education groups in France, offering preparatory programs and bachelor's degrees across art, design, digital, communication, and business.

A former ransomware negotiator from Florida has been sentenced to federal prison for helping BlackCat/ALPHV ransomware actors extort U.S. victims while he was supposed to be helping victims respond to attacks.

A man already serving a federal prison sentence has been charged with allegedly stealing and laundering cryptocurrency that had been forfeited to the United States.

Security researchers at Wiz have disclosed GhostApproval, a vulnerability pattern affecting several major AI coding assistants and exposing a trust-boundary problem between developers, AI agents, and the local filesystem.

A threat actor using the alias Monkeydance claims to have breached the Thepha District Public Health Office, a local health authority in Thailand operating under the Ministry of Public Health.

Norway’s National Criminal Investigation Service, known as Kripos, says 28 men have been arrested across seven countries in an international dark web operation tied to Monero payments.

A threat actor using the alias 84City has posted an SQL dump they attribute to ESGI (École Supérieure de Génie Informatique), a private French higher-education school specializing in IT and digital technology, based in Paris with campuses across France.

U.S. insurance provider AssuranceAmerica has confirmed a data breach affecting nearly 7 million people, exposing personal information and driver’s license numbers.

A remote code execution vulnerability in Foxit PDF Reader, tracked as CVE-2024-30326, highlights the continued risk of malicious PDF files being used as an initial access vector.

Noma Labs has disclosed GitLost, a prompt injection vulnerability that showed how GitHub’s AI-powered Agentic Workflows could be tricked into leaking private repository data through a public GitHub issue.

A threat actor using the alias Saturne is selling a database from Follow, a French Ségur-certified medical software and patient-record platform used by specialist doctors and surgeons.

A threat actor using the alias TheSyndicate claims to have fully compromised Nayax, an Israeli global payments and fintech company (NASDAQ: NYAX, TASE: NYAX.TA), stating they have been inside its systems for almost a year.

CVE-2026-11405 is an undocumented authentication backdoor in multiple versions of Tenda router firmware.