Mexico

This page covers cyber threats to Mexico. It uses the Banco de Mexico (central bank) statements on the 2018 payment system attacks, the Pemex statement of November 2019, the text of the 2017 National Cybersecurity Strategy, the 2025 data protection law as held on the official legal order site, a US government advisory, MITRE ATT&CK and Brandefense research. Many Mexican government sites (gob.mx, the Diario Oficial and the Congress site) block automated access, so this page uses only texts we could open. Where a source names Mexico as a target, the page says who said it and when.

Threat groups that official sources link to Mexico

Each group below has a profile in our threat group library. Attribution is stated as given by the named body.

APT38: the US advisory AA20-239A (last revised 24 October 2020), issued by CISA, the Treasury, the FBI and US Cyber Command, lists Mexico among the nations where a North Korean bank-robbing team it calls the BeagleBoyz likely targeted financial institutions from 2015 through 2020. The advisory says this team overlaps to varying degrees with the groups known as Lazarus and APT38. It describes the team as controlled by North Korea’s intelligence apparatus.

Lazarus Group: the same advisory names Lazarus as one of the groups the BeagleBoyz overlap with. It does not say that every Mexican case was the work of Lazarus.

MITRE ATT&CK also describes two groups that do not have a profile here. FIN13 is described as a financially motivated group that has targeted the financial, retail and hospitality industries in Mexico and Latin America since 2016. Malteiro is described as mainly targeting victims in Latin America, particularly Mexico, and in Europe, particularly Spain and Portugal. MITRE ATT&CK lists Mexico among the countries with confirmed victims of the Grandoreiro banking trojan.

Incidents on record

The incidents listed here are the major ones only. They are the 2022 leak of Defence Ministry email, the 2019 attack on the state oil company Pemex and the 2018 attacks on participants of the national payment system.

What official sources report

Payments (2018). The Banco de Mexico said on 22 May 2018 that five participants of the SPEI payment system had cyber security breaches and that irregular transfers under review came to about 300 million pesos. It said the central SPEI system it runs was not affected. Its forensic report of 29 August 2018 said the aim of the attacks was to create transfers to specific bank accounts to take money. It also said participants have had cyber security duties in its rules since July 2017 and that its supervision found uneven compliance.

Energy (2019). In a statement of 11 November 2019, Pemex said it received attempted cyber attacks on 10 November that were neutralized in time and affected less than 5 percent of personal computers. Pemex said its operating and production systems were not compromised. This is Pemex’s own account.

Government (2022). Bloomberg Linea reported on 30 September 2022 that President Lopez Obrador confirmed the Defence Ministry suffered a cyber attack in which confidential information was accessed. The report names a group called Guacamaya.

Fraud. The 2017 strategy quotes CONDUSEF, the financial users protection body. CONDUSEF said cyber fraud rose from 7 percent of possible fraud claims in the first quarter of 2011 to 42 percent in the same period of 2017.

How attackers target Mexico: Brandefense research

Banking and fraud. The Grandoreiro Trojan Technical Analysis says MITRE ATT&CK records the trojan as targeting financial sector victims in Brazil, Mexico, Portugal and Spain. Our Perspective of the Month on APT groups says BlueNoroff, a North Korean group, stole 81 million dollars from the Bangladesh Bank in 2016 and targeted other financial institutions in Mexico, Poland and Vietnam.

State-linked. Our Lazarus APT38 profile lists Mexico among 18 countries where malware known to belong to the group was seen. The Worok post says private companies and government agencies in Cambodia, Vietnam and Mexico are among those affected by the DropboxControl backdoor. The Equation APT Group post lists Mexico among countries it targeted, less often than others.

Ransomware. The Q2 2026 ransomware groups post lists Mexico among the most frequently targeted countries of the LockBit ecosystem.

How Brandefense helps

In plain words, Cyber Threat Intelligence is how a security team learns which groups and malware are aimed at its country and sector. Dark Web Monitoring is how it learns that staff or customer logins and payment cards are for sale, and Phishing Monitoring is how it finds fake sites that copy its brand.

Law and national strategy

The National Cybersecurity Strategy of 2017 sets out the vision of the Mexican State on cyber security. It has a theme on critical infrastructure, aimed at lowering risk and keeping services running after an incident. The data protection law for private parties was published in the Diario Oficial on 20 March 2025. It requires every controller to set and keep administrative, technical and physical security measures, and to tell people at once about security breaches that significantly affect their rights. The law’s decree moves the staff of the former data protection institute to the Secretaria Anticorrupcion y Buen Gobierno. We could not open the text of newer laws, such as the 2025 telecommunications and public security laws, so they are not described here.

How incident response is organized

The 2017 strategy says a Cybersecurity Subcommittee was created in October 2017, chaired by the Interior Secretariat through the National Security Commission. It lists CNBV (the banking and securities regulator) and CONDUSEF among its permanent guests. The strategy says the Federal Police Scientific Division issued more than 2,000 cyber security alerts to public and private institutions. These are 2017 arrangements, and we could not open newer official pages to check how the bodies are organized today. For payments, the Banco de Mexico sets cyber security rules for SPEI participants and supervises them.

Personal data

The 2025 law applies throughout the national territory to personal data held by private parties.

The official sources we opened give no attack counts for Mexico. Figures will come from Brandefense Atlas.