Actor claims theft of 104.2 million Mexican citizen records
A threat actor on an underground forum claims to have breached an unnamed 'major Mexican system' and obtained 104.2 million citizen records with full names, dates of birth, addresses and CURP-type national identifiers. The actor names no system, says the exploited flaw 'still remains exposed', and no victim or authority has confirmed the data; the source notes the volume may be compiled or recycled from earlier Mexican leaks. Treat as unconfirmed, watch for official confirmation and strengthen identity verification.
What happened
A threat actor on an underground forum claims to have breached a 'major Mexican system' and obtained 104.2 million citizen records. According to the actor, the data includes full names, dates of birth, home addresses and CURP-type unique national identifiers. The claim was surfaced by the DailyDarkWeb account and has not been verified.
Why it matters
Per the source's analysis, names, birth dates, addresses and national IDs in one set are ideal for identity fraud, SIM-swap, loan fraud and convincing fake government, tax or bank messages. Companies with customers or employees in Mexico may see waves of such fraud. The source itself cautions that a figure this large may be compiled or recycled from earlier leaks.
What to do
Treat as an unconfirmed claim and monitor official channels for victim or authority confirmation. Strengthen authentication and identity verification in customer service, credit and account recovery. Brief teams on social engineering that uses CURP-type data.
For the technical team
- Affected
- Sistema mexicano não identificado, descrito como 'major Mexican system'; banco de dados com 104,2 milhões de registros d · Unidentified Mexican system; no product, organization or version named in the sources.
- Exploitation
- Threat-actor claim only, on an underground forum, surfaced by DailyDarkWeb on 2026-10-27. No independent verification, no data sample and no visible field list in the captured post. No PoC and no indication of KEV listing.
- Fix
- Not applicable: no victim identified. The actor alleges the flaw 'STILL remains exposed', with no known fix.
- Vector
- Unknown. The actor cites a vulnerability in a 'major Mexican system', claims other threat actors had already exploited it and that it 'STILL remains exposed'. No component, flaw type or exploitation condition detailed.
- More details
- Fields claimed in the dataset: full names, dates of birth, home addresses and unique CURP-type national identifiers, totaling 104.2 million Mexican citizen records. The source assesses that a figure this large may be compiled or recycled from earlier Mexican leaks. The detailed post is restricted to DailyDarkWeb subscribers. No victim or authority has confirmed the breach so far.
Timeline
Incident opened.
Sources 1 source
- @DailyDarkWeb @DailyDarkWeb
