On 24 September 2026, Mexico's Secretaría Anticorrupción y Buen Gobierno (SABG) announced it had found signs of a possible personal-data leak through its own monitoring. A Telegram post dated 22 September offered databases allegedly tied to call centers, with a claimed total of more than 12.9 million records. The SABG said it would analyze what it had gathered and open investigations ex officio (SABG Comunicado No. 113).
The case is an early test of how the 2025 data protection law works in practice. It will show whether Mexico's new regulator goes after the people selling stolen data and the actual point of failure, or whether it settles for sanctioning whichever household names show up in a sample file.
What the regulator actually said
The SABG obtained a sample of 13,000 records from 13 databases. The claimed fields include full names, email addresses, landline and mobile numbers, birth dates, RFC tax IDs, home addresses and bank data. The trade names in the sample include Amazon, American Express, BBVA and Liverpool. Press coverage lists 23 brands in total, among them several Mexican banks, Sam's Club and Sears (Xataka México).
The authority was careful about what it did not say. It described the leak as possible and unconfirmed. It did not claim the 12.9 million figure is authentic, and it did not say the named brands were breached. Appearing in a sample shows that a customer relationship exists somewhere in the data. It does not show where the data was exposed. Call-center databases routinely aggregate records from outsourced vendors, marketing lists and earlier breaches. The SABG's restraint here is correct, and it is the part of the response that deserves praise.
The legal basis it cited is Articles 39 (section I), 54 and 55 of the Ley Federal de Protección de Datos Personales en Posesión de los Particulares (LFPDPPP), together with provisions of its own internal regulations (SABG Comunicado No. 113).
The strongest case for an aggressive posture
The argument for tough enforcement is serious. Records containing RFC tax IDs, birth dates and bank details are exactly what fraudsters need for impersonation and account takeover. Victims cannot rotate their birth date. Companies also hold structural advantages: they choose their vendors and write the contracts, and they decide how much to spend on security. Data subjects have no say in any of it. A regulator that waits for proof of exactly who leaked what may wait forever, and that delay lets sloppy data stewardship go unpunished.
This argument has real force, and the 2025 statute reflects it. The law was published in the Diario Oficial de la Federación on 20 March 2025, took effect the next day, and repealed the 2010 law. It transferred the private-sector data protection role of the dissolved INAI to the SABG (Hogan Lovells). The Xataka report summarizes the statute as requiring administrative, technical and physical safeguards against loss or unauthorized access, and notice to data subjects when a breach could significantly affect their rights. It also cites fines of 100 to 320,000 times the UMA, with higher penalties in some cases (Xataka México).
Where proportionality matters
The SABG has already shown it will use the penalty power. On 12 July 2026 it fined the Federación Mexicana de Futbol 42,849,095 pesos over its FAN ID system. It found three problems: the privacy notice did not say that the photos it collected were sensitive data; a website checkbox was not the express written consent required for sensitive data; and the FMF had not met the accountability and lawfulness principles. The release says the amount reflects the severity of the infractions, the sensitive biometric data and the FMF's economic capacity based on its 2024 tax return (SABG Comunicado No. 078).
That decision had a clear target and a documented reasoning chain: a specific controller, a specific practice and specific statutory duties. The Telegram case lacks all three at the moment. Three principles should guide what comes next.
- Establish provenance before attributing fault. If investigators find that a call-center vendor, a reseller or a recycled older breach is the source, the liability should land there. Fining a bank because its name appears in a file would punish the victim of a leak and would teach companies to hide incidents rather than report them.
- Reward early disclosure. Breach-notification duties work only if reporting does not automatically trigger maximum penalties. A regulator that treats every notification as a confession will receive fewer of them, and consumers will learn about leaks later.
- Go after the market, not just the controllers. The sale itself is the harm multiplier. Cooperation with platforms and law enforcement to identify sellers does more for the affected people than a compliance fine does. Takedown cooperation should be targeted at specific listings and rest on due process, so that it does not become a precedent for broad monitoring of private messaging.
What to watch
Three questions will show what kind of regulator the SABG intends to be. The first is whether it publishes its findings on authenticity, since the 12.9 million figure may be inflated or recycled. The second is whether it identifies a source and separates it from the brands that merely appear in the data. The third is whether any sanction follows the evidence in the way the FMF decision did, with stated reasons and a stated basis for the amount.
Mexico's 2025 law gives the SABG real tools, and the FMF fine shows it will use them. The leak probe is the harder test. If the agency follows the evidence to the source and is open about what it finds, it will strengthen trust in the regime. If it treats a sample file as a list of defendants, it will push companies toward concealment, which leaves consumers worse protected.