Instituto Mexicano del Seguro Social Bienestar

Summary

A hacktivist group known as the Chronus Group released data allegedly obtained from at least twenty‑five Mexican government institutions, including names, phone numbers, addresses, dates of birth, and proof of registration in the Instituto Mexicano del Seguro Social Bienestar, claiming a 2.3‑terabyte leak affecting 36 million individuals. Mexico’s ATDT agency responded that the material represents a compilation of earlier breaches rather than a new intrusion, that no sensitive data was found to be newly exposed, and that it has revoked compromised credentials and provided remediation to the affected agencies.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On January 30 the hacktivist collective known as the Chronus Group posted documents and data taken from at least twenty‑five Mexican government institutions, among them the Instituto Mexicano del Seguro Social (IMSS) Bienestar. The released material included names, telephone numbers, residential addresses, dates of birth and proof of registration in the public universal healthcare system. The group claimed the leak amounted to 2.3 terabytes of information affecting approximately 36 million Mexicans. According to threat intelligence firm Recorded Future the Chronus Group is a loose association of hackers that blends hacktivism with cybercrime and has been active since at least 2021. The posting appeared on dark‑web forums where the group advertises itself as a “cyberterrorism” entity. The announcement prompted immediate scrutiny from Mexican authorities and cybersecurity observers.

Mexico’s lead cybersecurity agency for defending government organizations, the ATDT, responded by rejecting the characterization of the event as a new breach. The agency stated that its analysis indicated the data were not freshly exfiltrated but a compilation of information from prior incidents. The ATDT emphasized that no sensitive data had been identified as published and noted that the affected systems were primarily obsolete platforms developed and maintained by private entities for state‑level bodies. In line with an initial phase of incident management the ATDT revoked any compromised access credentials and provided incident response and remediation support to the agencies that may have been exposed. Officials clarified that there was no evidence of a massive intrusion into the government’s core networks, suggesting instead that improper access occurred to specific decentralized environments or third‑party services handling government data. The ATDT remains the designated authority responsible for the cybersecurity posture of Mexico’s public sector.

The incident underscores a deteriorating threat landscape for Latin American organizations, which have become a leading target for cybercriminals, hacktivists and nation‑state actors worldwide. Reports indicate that Mexican entities face an average of roughly 3,065 cyber attacks per week. Detections of information‑stealing malware and other credential‑harvesting tools reached their highest levels in late 2024 for Mexico and neighboring countries such as Peru and have persisted as a significant threat. The episode highlights the risks associated with legacy systems and third‑party service providers that manage public‑sector data, reinforcing the need for continued vigilance and defensive measures across governmental and private entities in the region.

Sources

Sources available to members: 1 source.