Mexico has registered 43,116 cybersecurity incidents over the past two years, with the private sector absorbing 79% of the impact, according to data from the National Institute of Statistics and Geography (INEGI) cited by the consulting firm Salles Sainz Grant Thornton. The figures underscore the escalating digital threat landscape facing Latin America’s second-largest economy, where the average cost of recovering from a ransomware attack has climbed to $1.35 million, excluding any ransom payments.
Microenterprises on the Front Lines
The vulnerability is particularly acute given Mexico’s business structure. The 2024 Economic Censuses reveal that microenterprises account for 95.4% of the country’s 5.47 million private and parastatal economic units. These small operations often lack the resources, specialized personnel, and proactive security strategies needed to defend against sophisticated threats.
A diagnosis presented in April 2026 by the Economic Commission for Latin America and the Caribbean (ECLAC) identified key obstacles for micro, small, and medium-sized enterprises (MSMEs): high costs of security solutions, a shortage of specialized staff, systematic underestimation of risk, and a tendency to adopt only reactive measures after an incident has occurred. The report warns of a widening gap between the pace of business digitalization and the capacity to manage associated cyber risks.
Government Institutions Targeted
The public sector has not been spared. In early 2026, a security incident reportedly compromised at least 25 federal and state institutions, including the Tax Administration Service (SAT), the Mexican Social Security Institute (IMSS), and several state governments. According to Salles Sainz Grant Thornton, the breach resulted in the leakage of approximately 2.3 terabytes of data through attacks on technological platforms.
Investigations by firms such as Gambit Security suggest the perpetrators leveraged commercial artificial intelligence toolsâincluding Anthropic’s Claude Code and OpenAI servicesâto automate the identification of vulnerabilities in outdated systems managed by third parties. The attack has been attributed to hacktivist groups such as Chronus, alongside common cybercriminal actors, though these attributions rely on the reports cited by the consultancy.
High-Profile Corporate Breach
On September 20, 2025, the Ministry of Anticorruption and Good Government disclosed a potential exposure of personal data linked to flagship carrier Aeroméxico. Authorities detected a Telegram post offering a database allegedly containing over 15 million records. Investigators obtained a sample of 100,092 records to verify provenance and determine liability. Fidel Delgado, Data Analytics & Cyber Security Coordinator at Salles Sainz Grant Thornton, cited the case as a stark example of the risks private companies face regarding personal data exposure.
Regional Surge and Economic Stakes
The trend extends well beyond Mexico. The World Bank reports that major disclosed cyber incidents in Latin America and the Caribbean have grown 25% annually over the last decade. The institution estimates that reducing such incidents could boost the per capita GDP of a developing country by up to
Source: fayerwayer.com
