Hacker Claims Breach of Mexican Government System Exposing 104 Million Records

A threat actor known as GordonFreeman claims to have breached a major Mexican government system. The actor says the incident exposed 104.2 million records belonging to Mexican citizens.

The actor published a sample of the alleged dataset. The sample includes dates of birth, names, identification numbers, and residential addresses.

What the Actor Claims

GordonFreeman says the dataset contains 104.2 million records. The actor also claims to hold a 5 million-record proof-of-concept dataset. A proof-of-concept dataset is a minor sample which a vendor shares for the purpose of showing that a larger dataset exists. This does not indicate that all entries are authentic or relevant.

The actor says other people have already exploited the vulnerability. The actor also says the flaw remains unpatched. The post does not identify the government system that the incident affected. It also does not elaborate on the means of penetration into the network, as well as which agency possesses the information.

The claim has not been checked by security experts. No firm has confirmed the number of records, where the data comes from, and if the vulnerability exists or not. The allegation might include old records, duplicates, or data from earlier leaks. To verify its truth, researchers have to analyze the entire dataset.

The seller has not shared enough evidence to prove that the records came from one government system. They have also not shown that the data belongs to living Mexican citizens.

A large record count does not always mean a large number of people. One individual can appear multiple times because of duplicate records, previous addresses in the database, or multiple service record titles.

Why the Claim Matters

All the provided information about Mexican citizens may support identity theft. Criminals could use names, birth information, ID numbers, and addresses to impersonate individuals. They can also use the data to generate convincing messages to victims – they can pose as agents for government offices, banks, tax authorities, plus service providers.

In addition, a phone call might have the victim confirm personal information or make a payment. The truthfulness of the information may make these attempts more believable. Identification codes are even more sensitive. Criminals can commit account opening, loan fraud, benefit fraud, and a variety of other identity crimes using them.

If the leak actually happened, it would result in the victims facing harassment and fraud. The attackers may combine the exposed information with data from other leaks. The hackers may use addresses from the leak to send letters or delivery notifications. They may also use phone numbers for smishing and vishing attacks.

A smishing attack uses text messages, while a vishing attack uses phone calls. Both methods try to trick people – the tactics push victims into sharing passwords, codes, or payment details.

The Recent Cyber Incidents in Mexico

Mexico has faced several major cyber incidents in recent months. Experts reported an attack that used the help of AI against nine government organizations from December 2025 to February 2026. 

Consequently, the attacker stole more than 150GB of data, comprising taxpayer records, voter information, civil registry files, and government employee credentials. The researchers said the attacker exploited at least 20 security flaws. They also said the attacker used AI tools to find weaknesses and automate parts of the attack.

The earlier incident showed how attackers can move across government systems. It also showed the risk of unpatched software, weak monitoring, and poor network segmentation. The new GordonFreeman claim does not confirm a new breach. However, it adds to concerns about the security of Mexican public-sector systems.

A separate incident involved a hacker who claimed to be selling a Mexican tuberculosis database containing 305,000 patient records. The allegation raises similar concerns about the exposure of sensitive information held by public-sector systems.

The earlier case also showed why agencies must monitor unusual database activity. Attackers often test access, download data slowly, and hide their actions across many systems.

What Government Agencies Should Do

Government agencies need to respond to the above claim right away. They need to make sure that their systems haven’t suffered illegal access, unusual inquiries, and transfers of big number of files or data.

They need to close all of the vulnerabilities known to them and examine internet-facing services. Also, they should remove unused accounts and restrict remote access. Agencies should segment their networks – this limits the ability of an attacker to move from one system to another.

They should monitor databases for unusual downloads. They should also alert staff about phishing and social engineering attempts. Agencies should require multi-factor authentication for staff accounts. They should also limit administrative privileges and review access logs often.

The Agencies need to draw up a plan for what actions will take place in the case of a cyber-attack before it actually happens. Also, that plan must indicate who will be in charge of each of the stages of dealing with the incident.

In addition, citizens need to think twice before giving out their private information. Instead of talking to strangers via the phone, email, or text messages, they should go directly to their local official channels to make sure that they stay safe.

Also, citizens need to be on guard against fraudulent tax notices, updates regarding benefits, & other messages that demand account verification. They should never disclose any codes or passwords meant for one-time usage.

The GordonFreeman claim remains unverified. However, the alleged size of the dataset makes the report a serious security concern.