What the numbers say
On 7 September 2026, SCILabs, the threat-intelligence unit of Scitum TELMEX, published its Ransomware en LATAM, Primer Semestre de 2026 report. As reported by DPL News, it counts at least 290 verified ransomware incidents in Latin America in the first half of 2026, a 25.5% rise on the previous half-year. Brazil accounts for 25.17% of incidents. Mexico comes second with roughly 18%. Services (19.66%), government (11.72%) and manufacturing (8.28%) were the most-hit sectors. Three groups, The Gentlemen, Qilin and LockBit 5.0, account for about 48% of intrusions.
The qualitative finding matters more than the ranking. Attackers increasingly steal data and threaten to publish it. That shifts the harm from downtime, which backups can fix, to disclosure, which they cannot. U.S. cyber authorities describe the same pattern. CISA's #StopRansomware guide calls the combination of encryption and theft "double extortion" and notes that some actors skip encryption entirely and rely only on the threat of release.
The strongest case for a heavier state response
The argument for acting forcefully is serious. Ransomware crews operate across borders, and individual victims, from a municipal office to a mid-sized manufacturer, cannot out-spend them. Fragmented rules leave each victim to improvise. Without mandatory incident reporting, regulators and police see only a fraction of attacks, which makes the SCILabs count a floor rather than a ceiling. Critics of Mexico's current approach also say that a plan without a statute leaves private operators of critical services without binding minimum controls.
Mexico has moved on parts of this. The 2025-2030 National Cybersecurity Plan, published by the Digital Transformation and Telecommunications Agency (ATDT) in December 2025, targets the federal public administration. It envisions a national cybersecurity operations centre and a CSIRT for the federal government. Separately, Mexico adopted a general law on extortion in late 2025. Reporting by Expansión says it requires investigators to work social media, instant messaging and digital platforms. It raises sentences where private information is used to coerce a victim.
Why that is not enough
The extortion law answers the crime of the extortionist. Ransomware policy also has to answer the condition of the victim. Higher penalties deter little when offenders are mostly offshore, pseudonymous and organised as ransomware-as-a-service affiliates. The SCILabs data show concentration, with three groups behind nearly half of intrusions. That points to enforcement through international cooperation, infrastructure takedowns and financial tracing, not to longer sentences that few defendants will ever serve.
The cyber plan, for its part, is a federal-administration roadmap. Government is the second most-hit sector in the report, which is the plan's natural territory. Services and manufacturing together account for roughly 28% of incidents, and nothing binding reaches them. A voluntary plan cannot create the thing that most improves outcomes, which is a predictable, shared baseline of practice.
The cost of getting this wrong is real in both directions. A heavy statute that imposes prescriptive controls on every firm would burden the small and medium businesses that drive Mexican manufacturing and services, and would reward box-ticking over security. A statute that criminalises or penalises the victims who pay ransoms, or that sanctions firms for being breached, would push incidents underground and shrink the data regulators need.
A proportionate agenda
- Confidential, standardised incident reporting. Require significant incidents at critical-service operators to be reported to a single technical point of contact, with limited-use protections so reporting does not itself trigger punishment. Start with a narrow definition of covered entities and widen it only as evidence supports.
- Risk-tiered baseline controls. Offline backups, multi-factor authentication, network segmentation and patching discipline are the measures that blunt both encryption and exfiltration. Standards should be outcome-based and scaled to size, and published by the agency that will assess them.
- Safe harbours for good-faith defenders. Researchers and incident responders who access compromised infrastructure to protect victims need legal clarity, otherwise outdated unauthorised-access rules chill defensive work.
- Protect victims of the cleanup market. Extortion creates secondary predators. On 13 October 2026, the FTC announced a complaint alleging that an Ohio firm and its owner took at least $60 million from sextortion victims for "assistance" that was not delivered. These are allegations that a court will test, but the lesson carries over. Panicked victims of data-theft extortion are targets for fraudulent recovery services, so Mexico's regime should include clear consumer-protection enforcement against fake remediation vendors.
- International cooperation as the main deterrent. With a few brands driving most attacks, joint takedowns and shared indicators matter more than domestic sentence ranges.
The bottom line
The SCILabs report describes a market-structure problem. A small number of professional groups find that Mexican organisations are insufficiently prepared, insufficiently coordinated and insufficiently visible to the state. Mexico does not need maximal regulation, but it needs a general cybersecurity law that is narrow where it binds and light on small firms. Such a law should rest on confidential reporting, outcome-based baselines for critical services, and defender protections. Penalties for extortionists are fine as far as they go, but resilience, not retribution, is what will change next year's numbers.