Significant cyber incident
SEDENA Guacamaya hack and leak, Mexico, 2022
In late September 2022 a hacktivist group calling itself Guacamaya began leaking data taken from Mexico's Secretariat of National Defence (Sedena).
In short
In late September 2022 a hacktivist group calling itself Guacamaya began leaking data taken from Mexico's Secretariat of National Defence (Sedena). Reports put the size at about six terabytes and more than four million emails and documents. President Lopez Obrador confirmed on 30 September 2022 that the hack was real. The leak exposed internal military communications and started a long political dispute over military power and accountability.
What happened
On the night of 29 September 2022 a group calling itself Guacamaya began leaking material taken from Sedena, Mexico’s defense secretariat. Justice in Mexico describes the group as hacktivists and puts the release at about 6,000 GB. The Guardian says the leak covers more than four million emails and documents and more than six terabytes of data.
On 30 September 2022 President Andres Manuel Lopez Obrador confirmed the attack at his morning press conference. He said he believed the group was run from abroad and confirmed the health problems that the leak had revealed. Later he called the leaked information illegal because government data cannot be extracted or hacked (as quoted by the Guardian).
The leaked files fed months of reporting. Examples in the sources are surveillance of the US ambassador, reports of ties between officers and cartels, complaints received before the 2014 Ayotzinapa case, and, per Article 19, use of Pegasus spyware against a human rights defender. The defense secretary refused for months to appear before deputies.
Timeline
-
Before September 2022
Guacamaya had already released data from other Latin American governments, including Guatemala, El Salvador, Peru and Colombia (Justice in Mexico).
-
29 September 2022
The group begins leaking Sedena material. El Financiero says the leak was made public this day.
-
30 September 2022
President Lopez Obrador confirms the hack at his morning press conference and confirms his health problems.
-
4 October 2022
The President promises to publish procurement information about the Pegasus reseller, as cited by Article 19 in March 2023.
-
12 October 2022
The Defence Secretary tells deputies he will not attend a meeting at the chamber and offers to receive them at his offices (El Financiero).
-
18 October 2022
The planned meeting with the Defence Commission is canceled. The Movimiento Ciudadano group asks the coordination body to summon the Defence Secretary before the full chamber (Milenio).
-
19 October 2022
The President declines to take a press question about what Sedena did with the leaked information (El Financiero).
-
29 November 2022
Justice in Mexico notes the military has made no public statement a month after the leak and that the leak continues.
-
15 February 2023
The Defence Secretary meets the Defence Commission and says there are no sanctions yet (Forbes Mexico).
-
7 March 2023
Article 19 and partner groups say leaked documents show the Army used Pegasus against a human rights defender and ask Congress to summon Sedena.
-
26 April 2023
The Guardian reports on leaked emails about complaints received before the 2014 Ayotzinapa case. It says the government has not denied the emails are authentic.
How the attack worked
None of the opened sources gives a confirmed technical account of how Guacamaya got into Sedena. The government has not published one, and the Defence Secretary told deputies, as relayed by a deputy to Forbes Mexico, that the most sensitive data is kept where there is no internet access and that nothing endangering national security was compromised. This page therefore describes what the sources do establish.
What was taken
The Guardian says more than six terabytes were taken, covering more than four million emails and documents. Justice in Mexico lists photos, videos, files, conversations, plans and negotiations. El Financiero lists communications between the Defense and Navy secretaries, data on the President’s health, and contracts for the Tren Maya and the Tulum airport.
How it was released
The group released the material gradually, according to Justice in Mexico. Article 19 describes a briefing sheet and other documents that the group leaked. The groups behind the Army spying investigation then used the files to confirm earlier findings.
Why it matters technically
The files were a large mail and document store, and the sources show that outsiders were able to read years of internal communications at once. The sources do not say which flaw or credential was used, how long the attackers had access, or how the access was found. The Defence Secretary described the breach, as relayed by a deputy, as reaching a “second level” of information.
- IntrusionMethod not confirmed in the sources
- CollectionMore than six terabytes of mail and documents taken
- ReleaseMaterial leaked gradually from 29 September 2022
- ConfirmationThe President confirmed the hack on 30 September 2022
- FalloutReports on surveillance, cartel ties and military power followed
Who says who was behind it
Claimed by the group itself: the leak was published by a group calling itself Guacamaya (Justice in Mexico, 29 November 2022; the Guardian, 26 April 2023). Justice in Mexico describes it as an international hacktivist group that aims at mining and oil companies in Latin America and had earlier released data from other governments.
Attributed by the President, 30 September 2022: he said he understood the same group had done this in other countries and that it was run from abroad and not from Mexico. No evidence for this is given in the sources opened. No state or criminal sponsor is attributed by any government source here.
Impact
Data: more than six terabytes and more than four million emails and documents (the Guardian). Justice in Mexico says about 6,000 GB and four million documents.
Confirmation: the President confirmed the hack on 30 September 2022. El Financiero calls it the largest leak of confidential information in Mexican history.
Content: El Financiero lists communications between the Defense and Navy secretaries, the President's health data and Tren Maya and Tulum airport contracts. Justice in Mexico says Sedena monitored the US ambassador. Reports based on the files describe ties between officers and cartels.
People affected: the President's private health information became public. Article 19 says the files show a human rights defender was spied on with Pegasus.
Official assessment: the Defence Secretary told deputies, as reported by a deputy to Forbes Mexico on 15 February 2023, that no information endangering national security was compromised.
Sanctions: on 15 February 2023 the Secretary said there were no sanctions yet and that military justice was handling the investigation.
Government and regulator response
- President, 30 September 2022: confirmed the hack and said he believed the group acted from abroad. Later he called the leaked information illegal (as quoted by the Guardian).
- Defence Secretary, October 2022: on 12 October he told deputies he would not attend a meeting at the chamber and offered to receive them at his offices. The planned 18 October meeting did not take place. The Interior Secretary said the commission was not the body the Secretary answers to (El Financiero).
- Chamber of Deputies, 18 October 2022: the Movimiento Ciudadano group asked the coordination body to summon the Secretary before the full chamber (Milenio).
- President, 19 October 2022: declined a press question about what Sedena did with the leaked information (El Financiero).
- Defence Secretary, 15 February 2023: met the Defence Commission. A deputy said the Secretary told them no sanctions yet, the case was with military justice, and no information endangering national security was compromised (Forbes Mexico).
- Civil society, March 2023: Article 19 and partner groups asked Congress to summon Sedena over its Military Intelligence Center and cited a presidential promise of 4 October 2022 to publish procurement information.
- Press questions: the Guardian says its detailed questions to the defense ministry went unanswered.
Lessons
-
A large mail store is one big target
The leak covered over four million emails and documents. Years of internal mail in one place meant one breach exposed a whole institution.
-
Keep the most sensitive data off connected systems
The Defence Secretary said the most sensitive data is kept where there is no internet access. Even so, the leaked mail exposed health, surveillance and procurement matters.
-
Officials need an incident plan before the news breaks
Months of refusals to appear before deputies kept the story alive. A clear, early account to oversight bodies limits the damage.
-
Leaks reveal more than the breach
The files led to reports on surveillance and spyware use. Anything stored in mail can later be tested against other evidence.
-
Say what is known and what is not
No public technical account of the intrusion exists in the sources. That leaves room for speculation and weakens trust.
-
Hacktivists choose targets on purpose
Justice in Mexico says the group had hit other governments and companies. Public bodies in a region where one was hit should check their own exposure.
What to check in your own organization
-
Mail archive size and retention
Check how many years of email your organization keeps online. Archive or delete what is not needed so a breach exposes less.
-
Exposure of mail servers
Check that mail and collaboration servers are patched, monitored and not directly reachable where they do not need to be.
-
Separation of sensitive data
Check that the most sensitive records are not stored in ordinary mail and file shares.
-
Detection of bulk copying
Check you would notice multiple terabytes leaving your network over days or weeks.
-
Executive and leader data
Check what private data about senior leaders, such as health or travel, sits in mail, and who can read it.
-
Oversight reporting plan
Check who tells regulators, parliament or the board, how fast, and who answers questions in public.
-
Regional alerts
Check that you act when a group hits peers in your region, not only when it hits you.
Where it happened
- Industry Government and public sector State-backed espionage, supplier breaches, attacks on exposed servers and targeted phishing against public bodies, and the rules that apply.
- Country Mexico Mexico faces attacks on banks and payment systems, attacks on state bodies and companies, and banking fraud. Latin America
Questions
What was the SEDENA Guacamaya leak?
A hack and leak of Mexico's defense secretariat that began on 29 September 2022. The Guardian says more than six terabytes and over four million emails and documents were taken.
Did the government confirm it?
Yes. President Lopez Obrador confirmed the hack on 30 September 2022. The Guardian says the government has not denied the emails are authentic.
Who was behind it?
A group calling itself Guacamaya. Justice in Mexico describes it as hacktivists. The President said he believed it was run from abroad. No state sponsor is attributed in the sources.
How did the attackers get in?
The sources opened do not say. No official technical account has been published in them.
What did the leak show?
Examples in the sources include the President's health data, Tren Maya and Tulum contracts, monitoring of the US ambassador, and, per Article 19, Pegasus use against a human rights defender.
Was anyone sanctioned?
On 15 February 2023 the Defence Secretary told deputies there were no sanctions yet, according to a deputy quoted by Forbes Mexico.
Sources
- Confidential Mexican Military Documents Leaked by Hacktivist Group Justice in Mexico, 29 Nov 2022
- Mexico army ignored cartel warnings before mass student kidnapping, emails show The Guardian, 26 Apr 2023
- No vamos a manchar la mananera: AMLO evita que Sedena responda preguntas sobre el hackeo El Financiero, 19 Oct 2022
- MC pide comparecencia del titular de Sedena por hackeo al Ejercito Milenio, 18 Oct 2022
- Diputados se reunen con titular de Sedena; les dice que aun no hay sanciones por hackeo Forbes Mexico, 15 Feb 2023
- Mexico: Army used Pegasus to spy on human rights defender Raymundo Ramos ARTICLE 19, 7 Mar 2023
- Mexican president confirms 'Guacamaya' hack targeting regional militaries The Record, 30 Sep 2022
- A Q&A with the hacktivists rocking Latin America: Guacamaya The Record
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 49 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 24 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 46 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 36 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 44 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 103 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.