Cyber Incident Victim: Secretaría de Comunicaciones y Transportes
Date:
Oct 2022
Location:
Mexico
Summary
A cyberattack targeting Mexico’s transportation ministry disrupted operational services, prompting the agency to suspend issuing permits, license plates, and driver’s licenses for commercial truck operators. The incident activated established contingency protocols and investigations, with officials stating no system damage or personal data compromise occurred despite the service interruptions.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On October 24, 2022, Mexico’s Secretariat of Infrastructure, Communications and Transportation (SICT) experienced a cyberattack that disrupted its operational systems. The agency publicly confirmed the incident via a Twitter announcement, disclosing that its servers had been hacked. SICT activated its Cyber Incident Management and Contingency Plan in response, though specific technical details about the attack vector or intrusion methods were not disclosed. Investigations into the breach commenced immediately, though no external cybersecurity partners or law enforcement agencies assisting in the response were identified in official statements. SICT asserted in a news release that the malicious software attack did not cause permanent damage to its systems and did not compromise citizens’ personal data. The agency did not specify whether ransomware was involved or whether data exfiltration occurred.
The cyberattack caused significant operational disruptions, forcing SICT to suspend all issuance of new permits, commercial license plates, and driver’s licenses for truck operators through at least December 31, 2022. This suspension was formally announced in the federal government’s official periodical, indicating the severity of the system unavailability. The halt in permit processing created potential delays for commercial transporters reliant on these administrative functions, though the economic impact was not quantified. SICT maintained public communication about recovery efforts but provided no timeline for full restoration of services beyond the December 31 deadline. No threat actor claimed responsibility for the attack, and SICT did not release additional forensic findings regarding the scope of compromised systems or potential attribution.