Cyber Incident Victim: Ayuntamiento de Tepotzotlán
Date:
May 2025
Location:
Mexico
Summary
The official Facebook page of the Ayuntamiento de Tepotzotlán was compromised when unknown actors replaced the profile and cover images with the Guy Fawkes mask associated with Anonymous and posted a short video featuring the same imagery. Municipal authorities confirmed the unauthorized access, filed a cyber‑police report, and contacted Meta for assistance while working with cybersecurity specialists to restore the account. The alteration generated over 250 reactions and 20 comments before the page was secured.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
On the morning of May 5, 2025, the official Facebook page of the Ayuntamiento de Tepotzotlán in the State of Mexico was altered by an unauthorized access that municipal authorities described as a hacking. At approximately 5:24 a.m., the page’s profile picture, which previously displayed the letters “Tepotzotlán” alongside the slogan “¡Con espíritu de amor y servicio!”, was replaced by the Guy Fawkes mask known from the V de Venganza graphic novel and its 2005 film adaptation. Simultaneously, the cover photo was modified to show a figure wearing the same mask and a burgundy hoodie bearing the word “Thrasher” positioned beside the municipal tourist lettering. A brief story was also posted to the page, featuring the mask and the letters of Tepotzotlán. These were the only changes noted in the article’s edition.
Following the alteration, the Ayuntamiento issued a communiqué on its website confirming that the Facebook page had been subjected to an unauthorized access and announced that a complaint had been filed with the cyber police for the recovery of the account. The municipal authorities also contacted Meta Platforms Inc., the parent company of Facebook, to seek assistance in restoring the page. The responsible municipal area reported that it was already collaborating with cybersecurity specialists to address and resolve the incident as quickly as possible. In parallel, the Ayuntamiento urged the media and the general public to obtain information exclusively through its official website and requested that users refrain from sharing or interacting with any content posted on the compromised Facebook page. Despite these warnings, the altered profile picture attracted more than 250 reactions and twenty comments from Facebook users.
No definitive cause for the vulnerability had been established at the time of the report. Earlier in March 2025, the municipal president María de los Ángeles Zuppa Villegas had requested an indefinite leave of absence to attend to personal matters, leading to her temporary separation from the office. Subsequently, an extraordinary session of the local cabildo approved the appointment of second regidor Juventino Lozano as mayor under the Ministry of Law provision.