🇲🇽 🚨 MEXICO: 104.2 MILLION CITIZEN RECORDS ALLEGEDLY STOLEN FROM AN UNNAMED "MAJOR MEXICAN SYSTEM" A threat actor on an underground forum claims to have breached "a major Mexican system" and obtained a database of 104.2 million records of Mexican citizens. The actor does not name the system or organization. The actor claims the dataset includes: * 104.2 million records of Mexican citizens * Full names and dates of birth * Home addresses * Unique national identifiers (CURP-type IDs) The actor also says the vulnerability used had already been exploited by other threat actors and "STILL remains exposed". The claim has not been independently verified. ⚠️ Analyst Note: A set tying names, dates of birth and addresses to national ID numbers is ideal for identity fraud, SIM-swap and loan fraud, and convincing fake government, tax or bank messages. No source system, sample or field list is visible in the captured post, and a figure this large may be compiled or recycled from earlier Mexican leaks. Unverified threat-actor claim, NOT confirmation of a breach. Source: this is for subscribers only. Subscribe: xitter.cf/DailyDarkWeb/creator-s… #DDW #DarkWeb #Mexico #DataLeak #PII #IdentityFraud #ThreatIntelligence

🇲🇽 🚨 SAFEPAY RANSOMWARE CLAIMS MEXICO'S AUTONOMOUS UNIVERSITY OF AGUASCALIENTES The SafePay ransomware group has listed the Universidad Autónoma de Aguascalientes (UAA), a public university in Aguascalientes, Mexico, on its leak site. The listing appeared on Oct 26, 2026 (UTC). The group has not shared details on the volume or type of data allegedly taken. Context: On Oct 14, 2026, local media reported that the UAA detected intrusion attempts on its servers that disrupted institutional email, its E-SSIMA student platform and its virtual classroom. The university said at the time that no data had been extracted. Whether that incident is linked to this claim is not confirmed. ⚠️ Analyst Note: Universities hold student, staff and applicant records. If the claim holds, students and staff should expect university-themed phishing and should not open unexpected attachments or password reset links. Unverified threat-actor claim, NOT confirmation of a breach. #DDW #DarkWeb #SafePay #Ransomware #UAA #Aguascalientes #Mexico #Education #ThreatIntelligence #CyberSecurity

🇲🇽 🚨 MEXICO: COLIMA STATE GOVERNMENT DATABASE ALLEGEDLY EXPOSED, 720K RECORDS A threat actor on an underground forum has posted what they claim is a database belonging to the Gobierno de Colima, the state government of Colima, Mexico. The listing title claims the dataset contains about 720,000 records. The visible part of the listing does not specify which data fields, systems or time period are involved. The claim has not been independently verified. ⚠️ Analyst Note: State government databases can hold citizen, taxpayer or public-servant records, so a 720K-record set could carry real phishing and fraud risk if authentic. However, the post shows no field list or sample here, and government datasets are often repackaged from older leaks or public portals. Unverified threat-actor claim, NOT confirmation of a compromise of Colima state government systems. Source: this is for subscribers only. Subscribe: xitter.cf/DailyDarkWeb/creator-s… #DDW #DarkWeb #Mexico #Colima #DataBreach #Government #ThreatIntelligence

🌎 🚨 THE GENTLEMEN RANSOMWARE LISTS SAP LATIN AMERICA The Gentlemen ransomware group has added SAP to its leak site, describing the victim as SAP Latin America and Caribbean, the regional arm of the German enterprise software giant that runs operations across about 10 countries, with Brazil as its largest market. The listing appeared on Oct 26, 2026 (UTC). The group has not shared details on the volume or type of data allegedly taken. It comes two days after a separate, unrelated actor claimed a 31 GB leak tied to SAP's Ecuador operations. The claim has not been independently verified, and SAP has not publicly confirmed a cyber incident. ⚠️ Analyst Note: A regional SAP unit holds customer contracts, project files and partner data for thousands of large enterprises. If the claim holds, SAP customers and integrators in the region should watch for SAP-themed phishing and fake invoice or support requests. Unverified threat-actor claim, NOT confirmation of a breach. #DDW #DarkWeb #TheGentlemen #Ransomware #SAP #LatinAmerica #Brazil #ThreatIntelligence #CyberSecurity

🇲🇽 🚨 QILIN RANSOMWARE NAMES AIRBUS SLC MÉXICO The Qilin ransomware gang has listed Airbus SLC México on its leak site. The Mexico City-based unit is Airbus's Public Safety and Security business in the country, supplying mission-critical TETRA and Tetrapol radio networks, dispatch and secure mobile broadband (MXLINK) to public safety, defense, transport and utility users. The listing appeared on Oct 26, 2026 (UTC). No details on the volume or type of data allegedly taken have been shared so far. The claim has not been independently verified, and Airbus has not publicly confirmed a cyber incident at the unit. ⚠️ Analyst Note: A vendor running radio and dispatch systems for police, emergency and state agencies holds sensitive network, customer and project data. If the claim holds, government customers should review vendor access and watch for targeted phishing. Unverified threat-actor claim, NOT confirmation of a breach. #DDW #DarkWeb #Qilin #Ransomware #Airbus #CriticalInfrastructure #Mexico #ThreatIntelligence #CyberSecurity

🇲🇽 🚨 MEXICO: MEXICAN GEOLOGICAL SERVICE (SGM) OFFICIAL EMAIL SYSTEM ALLEGEDLY HACKED A threat actor on an underground forum claims to have hacked the official email system of the Servicio Geológico Mexicano (SGM), Mexico's geological survey agency, specifically its Regional Coordination Office in the San Gregorio Atzompa area. The actor claims to have taken control of the agency's government correspondence system and extracted its archive, including: * Hundreds of internal documents and official announcements * Employee records and senior management correspondence * Salary, financial obligation and staffing-structure details * Personal data of government employees The actor also claims the systems were "wiped" and threatens to publish the data if unspecified demands are not met. A sample of documents is attached to the post. The claim has not been independently verified. ⚠️ Analyst Note: If authentic, government mailbox archives expose employee personal data and internal correspondence that can be reused for highly convincing spear-phishing and business email compromise against Mexican public agencies. The "hacked and wiped" and extortion language is unproven, and the scope may be limited to one regional office. Unverified threat-actor claim, NOT confirmation of a compromise of SGM systems. Source: this is for subscribers only. Subscribe: xitter.cf/DailyDarkWeb/creator-s… #DDW #DarkWeb #Mexico #DataBreach #Government #Extortion #ThreatIntelligence