Nine Mexican organizations turned up on ransomware leak sites in the past seven days, posted by six different crews, according to IntelFusions incident tracking. That puts Mexico back at its mid-August level, the spike behind our report that Mexico was suddenly all over the leak sites. In the eight weeks in between, the weekly count ran between one and five.
These are unverified claims made by the gangs themselves. None of the organizations named below has confirmed a breach in anything we have seen, and a leak-site listing is not proof that data was stolen.
Qilin posted four in a single day
Nearly half the week came from one crew on one day. On October 30 Qilin listed four Mexican businesses: technology firm Sistemas Visuales 360, a pharmacy business listed as Farmacia I, Grupo Ciosa, and consultancy Innoe Asesores. In our data those listings carry nothing beyond names and sectors, so there is no indication of what, if anything, was taken.
The same day Rhysida posted the most detailed claim of the week, against Cipsa Industrias, which the listing describes as a maker of corrugated cardboard, packaging and paper tubes. Rhysida says it holds complete employee HR records, including CURP, RFC and IMSS numbers, salaries and badge photographs, along with payroll bank files containing employee account details. If that is accurate, the exposure falls mostly on the company's own workers rather than its customers, and it is exactly the kind of data that feeds identity fraud.
A public university and an energy group
The best-known name sits on SafePay's site. On October 31 the crew listed the domain uaa.mx, which belongs to the Universidad Autónoma de Aguascalientes, a public state university. The listing describes an institution teaching undergraduate and postgraduate programs across engineering, natural sciences and health sciences.
Earlier in the week, on October 27, the Dire Wolf crew listed Grupo Petroil, which our data files under energy and utilities. The Gentlemen added Grupo Sanirent, described in its listing as a Mexico City portable sanitation and waste management company operating in all 32 Mexican states, and LockBit posted a single domain with no further detail.
Two listings that were not Mexican at all
Our raw count for Mexico this week was 11, not nine. Two entries were tagged to Mexico, but their own listing text places them elsewhere: one describes an Ecuadorian road freight company and the other a general contractor in California. We have left both out of every figure above. Leak-site metadata is written by the gangs and is often wrong, which is one more reason to treat these counts as a signal rather than a census.
Ask suppliers directly, then lock down remote access
Mexico is rated a high-targeting country on its IntelFusions country profile, and its national CERT is CERT-MX. Organizations that recognize a supplier, partner or payroll provider in these listings should ask that party directly rather than wait for a disclosure, and rotate any shared credentials or VPN access. With six unrelated crews involved there is no single set of indicators to hunt for, so patching internet-facing systems, multi-factor authentication on every remote access path, and offline, tested backups do most of the work.
August's spike faded within two weeks. Whether this one does is the thing to watch, because a second surge inside ten weeks would suggest Mexican networks have moved onto more target lists for good rather than passing through them.
This briefing is provided by IntelFusions for informational and defensive purposes only. It summarizes extortion claims published by ransomware leak sites. Those claims are made by the attackers, are unverified, and may be false, exaggerated, or recycled from earlier breaches. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.