Cyber Incident Victim: Coppel SA de CV
Date:
Apr 2024
Location:
Mexico
Summary
Coppel confirmed a cybersecurity incident affecting its systems, prompting the activation of protective protocols to safeguard customer, employee, and supplier data, with no evidence of information theft identified. While its banking subsidiary BanCoppel remained unaffected due to independent operations and continued normal services, Afore Coppel experienced system failures requiring customer service restoration efforts; retail locations maintained standard operations throughout the incident.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 2 motives | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
Coppel identified a cybersecurity incident affecting its systems in the days preceding April 20, 2024, prompting an official public confirmation on that date. The company activated established protection protocols immediately upon detecting the incident to safeguard customer, employee, and supplier data. Internal investigations conducted up to the announcement date found no evidence confirming unauthorized extraction of information from Coppel’s systems. The retailer reinforced its security measures and controls following the breach but maintained normal store operations and service availability throughout the incident. Bancoppel, Coppel’s banking subsidiary, operated without disruption due to its independent infrastructure, continuing routine customer transactions via branches, ATMs, and digital channels.
Afore Coppel, the company’s pension fund management division, experienced service interruptions lasting multiple days, creating uncertainty among users attempting to access customer support. Restoration efforts for Afore Coppel’s systems were ongoing as of April 20, though no explicit connection was made between these disruptions and the cybersecurity incident affecting the parent company. Coppel emphasized that core retail services remained unaffected, with stores adhering to standard operating hours and fulfilling customer transactions. The organization did not disclose technical details regarding the attack vector, intrusion duration, or specific systems compromised. No ransomware claims, threat actor attributions, or regulatory filings were referenced in the initial confirmation statement.