Qilin added Cinépolis to its leak site on 21 August, and about two hours later it added Quaker State Mexico. One is among the world's largest cinema chains, founded and headquartered in Mexico. The other carries the name of a motor oil brand sold across the country. Neither has publicly acknowledged an incident, and both entries are what every leak-site post is: an accusation made by the people who say they did it.
What makes the week unusual is not either listing on its own. Nine Mexican organizations were posted to ransomware leak sites in the seven days to 22 August, by six separate crews. Over the previous twelve weeks Mexico averaged fewer than four listings a week.
Six crews, and nothing tying them together
Qilin was the busiest with three: the builder Constructora Jimenez on 19 August, then Cinépolis and Quaker State Mexico on 21 August. The group posted nine Mexican victims across the previous twelve weeks; it added three more in this one. Dire Wolf posted two within minutes of each other in the early hours of 21 August, Aztec Software and iSON XPERIENCES. Space Bears listed SEARS (Grupo Sanborns) on 15 August. Everest, whose leak site advertises an appetite for customer records and payment data, listed Grupo DT on 20 August. 3AM posted the domain mecasem.org on 19 August, and The Gentlemen added a beach resort tagged to Mexico on 21 August.
The sectors do not line up either: retail, cinemas, lubricants, construction, outsourcing, software. Nothing in the posts connects the six operations, which is what makes the cluster worth noting rather than dismissing as one affiliate working a list.
Mexico is not usually this high on the board
Across the previous twelve weeks Mexico sat eleventh worldwide in our leak-site tracking, with 44 claims. In the week to 22 August it drew level with France and trailed only the United States, Germany, Italy and the United Kingdom. Mexico's country profile already carries a high targeting rating, and extortion crews are not the only pressure on it. Days earlier, researchers documented a rented phishing service using AI generated voice calls against customers of Mexican banks.
A listing is a claim, not a confirmed breach
This is worth stating plainly, because a number like nine invites over-reading. Crews post names to apply pressure, usually before a negotiation has failed rather than after it. Some listings recycle data stolen elsewhere, some inflate what was taken, and a few name organizations the crew never touched. The country tag comes from the tracker rather than from the victim, and it is occasionally wrong. What these nine entries establish is a change in what the crews are advertising about Mexico. Whether nine Mexican companies actually lost data is a separate question, answered one case at a time, over the weeks that usually takes.
Check your exposure before the files land
None of the posts describes how the crews got in, so there is no single patch to name here. Mexican organizations, and multinationals with Mexican subsidiaries, should check whether their own name or a supplier's has surfaced on any of these sites, because a listing is often the first notice a company gets that anything happened. Assume customer records are the product being sold, and get legal and communications people into the room before publication rather than after it. Where a named company is a consumer brand, the second-order risk is phishing built on the story itself: refund and account-verification messages that borrow the incident for credibility.
One busy week is not a trend, and the honest reading of nine posts is that they are nine posts. It is still a marker worth keeping. If the next fortnight looks like this one, Mexico will have moved into a bracket it has not occupied before.
This briefing is provided by IntelFusions for informational and defensive purposes only. It summarizes extortion claims published by ransomware leak sites. Those claims are made by the attackers, are unverified, and may be false, exaggerated, or recycled from earlier breaches. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.