AI facilitates wave of cyber-attacks in Mexico: 116 companies hacked in 7 weeks

In Mexico, in the last 7 weeks, 116 confirmed companies have been hacked. 101 data breaches.

Airlines. Theme parks. Banks. Retail chains. Universities.

And what scares me most: the attackers are using AI to automate and accelerate their operations.

This is not an isolated incident. Is a wave.

What is happening

The numbers

FACT (according to The Financial):

The signature of cybersecurity IQSEC documented during 7 weeks of monitoring in the first half of 2026:

• 116 confirmed victims
• 101 data breaches
• Companies of all sectors (airline, tourism, finance, retail, education)

Companies attacked

Known victims include:

• Aeromexico (airline)
• Xcaret (theme park)
• Multiple mexican banks
• Retail chains
• Educational institutions

The factor IA

FACT: The attackers are using AI to automate the attack:

• Automated recognition of vulnerabilities
• Data exfiltration automated
• Scaling automated privileges
• Evasion of detection assisted by AI

What used to take weeks or months it now takes hours or days.

Why it is happening in Mexico

Vulnerability 1: Maturity security limited

ANALYSIS: mexican Companies typically have:

• Limited budget in security (compared to USA or Europe)
• Staffing of security reduced
• Legacy systems without patches
• Lack of defense-in-depth

Vulnerability 2: Lack of correlation of alerts

Even if there is intrusion detectors:

• Each company operates independently
• There is No visibility of ‘national standards’
• There is No coordinated response
• Each attack is treated as an isolated incident

Vulnerability 3: Access to tools of attack democratized

DONE: hacking Tools, exploits and malware are publicly available. With AI:

• An attacker amateur can be as effective as a professional
• You can automate massive attacks
• You do not need expertise deep

How AI is accelerating the attacks

Phase 1: Recognition (before: weeks, now: hours)

Before: Attacker manually scan networks, identifies vulnerabilities, maps infrastructure.

Now: AI automatically scans 1000s of companies, identifies common vulnerabilities, create profile attack in parallel.

Result: 116 companies scanned, analyzed and prioritized in days, not weeks.

Phase 2: initial Access (before: days/weeks, now: hours)

Before: Attacker manually try to exploits, wait, iterates.

Now: AI tries multiple exploits in parallel, choose the most effective, you get access.

Result: Access to 116 companies in hours of onset of the attack.

Phase 3: lateral Movement (before: weeks, now: minutes)

Before: Attacker scans the network manually, identifying critical systems, planned way.

Now: AI automatically mapping the network, identifies critical servers, creates access road optimized.

Result: the point Of entry to the data server in minutes.

Phase 4: Exfiltration (before: hours, now: minutes)

Before: Attacker identifies what data is valuable, the compressed, encrypted, the exfiltpa slowly to avoid detection.

Now: IA identifies data valuable automatically (scoring value), compresses, encrypts, exfiltpa in parallel from multiple points.

Result: Terabytes of data exfiltrados in minutes from 116 companies.

The impact

For mexican companies

• Customer data stolen
• Financial information exposed
• Trade secrets filtered
• Reputation damaged
• Remediation costs

For mexican citizens

• Personal information on the dark web
• Risk of identity theft
• Privacy compromised

For the economy

Estimated losses: billion in remediation + loss of confidence + reputational harm.

How to 24Cevent would have helped

If the 116 companies, had detection of abnormalities correlated at the national level in English:

Detection of coordinated recognition

When the IA you are scanning multiple companies:

• Company 1: ‘Volume anomalous traffic scanning’
• Company 2: Port scan detected’
• Company 3: ‘connection Attempts to port common’
• Company 4-20: Same pattern

Without 24Cevent: ‘Probably noise, it probably is’backup

With 24Cevent at the national level:

• Correlation: ’20 companies with the same pattern of recognition at the same time’
• Analysis: ‘coordinated Attack detected’
• Context: ‘Originating from ASN-X / region And’
• Escalation: ‘INCIDENT of NATIONAL: Wave of recognition in progress’
• Answer: ‘Lock source + notification GCSIRT + alert to all companies’

The 116 companies receive alert: ‘coordinated Attack in progress. Here is what to look for. Here is how to defend.’

Detection of exfiltration massive

When AI attempt to exfiltration from multiple companies:

• Company 1: ‘Download data in bulk’
• Company 2: ‘Download data in bulk’
• Company 3-20: Same pattern to the same destination

With 24Cevent:

• Correlation: ’20 companies with exfiltration of data to the same location (IP darknet) simultaneously’
• Escalation: ‘CRITICAL INCIDENT: Exfiltration data in bulk mexican coordinated’
• Answer:
  • Target locking in firewalls national
  • Notification to GCSIRT
  • Notice to internet service providers to block
  • Coordination with providers of DNS to block

In place of 116 companies being completely exfiltradas, it blocks the majority in minutes.

Detection pattern IA

SPECULATION CONTROLLED: The AI generates patterns detectable:

• Speed anomalous attack (too fast to be human)
• Massive parallelization (multiple vectors simultaneously)
• Mathematical pattern in the selection of objectives
• Automation of lateral movement

With 24Cevent:

• Analysis: ‘Pattern of attack is consistent with automation of AI’
• Prediction: ‘the Next wave of attacks will be in X, sectors, And regions, Z hours’
• Proactive defense: ‘Reinforcement of the defenses in sectors/regions predicted’

Result

Without 24Cevent:

• 116 companies attacked successfully
• Massive data exfiltrados
• Accidental discovery
• Response chaotic

With 24Cevent:

• First attack detected in the phase of recognition
• Following 115 companies alerted before being attacked
• Exfiltration blocked
• Coordinated defense national

The lesson for Latin america

This incident in Mexico shows that:

1. The massive attacks coordinated are possible at a regional level
2. The AI is accelerating exponentially attack speed
3. Without detection correlated, each company is single
4. The answer must be national/regional, not by company

Latin america needs:

• Detection of threats in English to understand regional context
• Alert correlation at the level of country/region
• Coordinated response between business and government
• Automation of defense

24Cevent is designed for Latin america

24Cevent is a platform for incident management designed specifically for businesses, and governments of Spanish-speaking Latin america.

Why it’s different:

1. Correlation smart in Spanish

Understand attack patterns in Latin american context. It is not a tool american translated. It is native to.

2. Scalability national/regional

You can correlate indicators of multiple companies/agencies at the national level. A company in CDMX, you can be alerted of patterns in Monterrey is watching.

3. Automation of response in context

Not only alert. Automates answer that makes sense for regulators and companies in latam. Notifications to GCSIRT, coordination with ISPs, national, etc

4. Affordable for medium-sized businesses

The majority of companies in Latin america, are medium-sized. 24Cevent is designed to be accessible, not only to the Fortune 500.

5. Support in Spanish, computer in Latin america

It is not support remote time zone of the us. Is a local team that understands the region.

For Latin america, this is critical. Because the attacks do not respect borders, but the defense must be coordinated locally.

SOURCES CHECKED:

• The Financial – IA facilitates cyber-attack in Mexico