from Mercado Libre to Guacamaya

Cybercriminals and hacktivists do not stop setting their sights on Mexico. The country is one of those that receives a greater amount of cyber attacks of all kinds in the Latin American region and this 2022 was no exception. Public institutions and private companies were victims of cyberattacks that, in some cases, caused disclosures of personal information but also led to the interruption of their operations.

Three of the five incidents of cybersecurity listed below were attacks by ransomwarethat is to say, the kidnapping of information for extortion purposes, while the other two cases deal with exfiltration through the email system and the installation of a spy malware. In the face of these cyberattacks, a regulation that offers a legal framework for the defense of Mexican cyberspace and that protects State institutions that have become habitual victims of cyberattackers still has not been finalized in the Legislative Branch.

Free market

In March 2022, the e-commerce company Free market admitted that part of the source code of its platform suffered unauthorized access, as well as the data of 300,000 users in Latin America. At the time, the Latin American e-commerce giant in Mexico reported that the hack had affected 50,000 Mexican user accounts, although it was later learned that there were more.

The hack to Free market surrounds a set of ransomware attacks carried out by the group SLIP$which included the technological integrator also of Argentine origin, They are gloatingto the largest Latin American franchisee of McDonald’s, Golden archesand the Mexican bank Citibanamex.

Foxconn

In May 2022, Foxconnone of the leading providers of Apple, suffered a ransomware attack at its plant in Tijuana, Baja California, after it had already suffered such an incident at its plant in Ciudad Juárez, Chihuahua. The attack on a manufacturing company like Foxconn highlights the digitization that this industry experienced during the Covid-19 pandemic, which caused up to 18% of manufacturing companies in Mexico to suffer cyberattacks, according to Index.

macaw

Last September, the digital medium Latin made public some documents allegedly extracted by the hacktivist group Guacamaya from the Ministry of National Defense. Mexican President Andrés Manuel López Obrador confirmed in his morning conference the hacking of the secretariat by the hacktivist group, which extracted 10 terabytes of information from different institutions in Latin American countries, of which 6 terabytes correspond to information protected by the Mexican army .

The extraction of information from the Sedena was carried out by taking advantage of a vulnerability in the Zimbra email service. The authority for the protection of personal data, the Inai, opened an ex officio investigation into this hack, after the notification of the Mexican army did not satisfy the information needs of the institute.

Pegasus

The hacking of the Sedena by the group Guacamayto revealed that spyware Pegasus it has continued to be used during the administration of President Andrés Manuel López Obrador. The Network in Defense of Digital Rights, together with Article 19, Social TIC and the Animal Político, Aristegui Noticias and Proceso media outlets presented the Spy Army investigation last October, in which they confirm the surveillance by the Sedena of the journalist Ricardo Rafael, the president of the Nuevo Laredo Human Rights Committee, Raymundo Ramos, and a journalist from the digital media Political Animal.

The two journalists and the human rights defender join a long list of Mexican citizens who have been spied on using software tools used to carry out surveillance work against the civilian population without the necessary judicial controls.

SICT

In November, the Ministry of Infrastructure, Communications and Transportation (SICT) announced the suspension of deadlines and terms of various procedures and licenses of both the secretariat itself and the Federal Civil Aviation Agency between October 24 and December 31, 2022, in order to “safeguard the systems and information” in the face of a cyber incident suffered by the federal Executive branch.

Rogelio Jiménez Pons, Undersecretary of Transport, confirmed that the secretariat had suffered an attack from ransomware that affected 10% of their computer equipment. The administration did not make any payment to recover the information, according to Jiménez Pons, who added that the SICT will probably normalize its operations in January.

rodrigo.riquelme@eleconomista.mx