Chronus Group Claims Massive Mexican Government Data Breach But Authorities Downplay Impact A hacktivist collective known as the Chronus Group has claimed responsibility for a 2.3-terabyte data leak allegedly exposing the personal information of 36 million Mexicans roughly 28% of the country’s population. The compromised data, posted online, reportedly includes names, phone numbers, addresses, dates of birth, and proof of registration in Mexico’s public healthcare system, IMSS Bienestar. However, Mexico’s Agencia de Transformación Digital y Telecomunicaciones (ATDT), the government’s lead cybersecurity agency, has challenged the severity of the breach. Officials state that the leaked data appears to be a compilation of older breaches rather than a new, large-scale intrusion. According to an ATDT spokesperson, the incident likely stemmed from "improper access to decentralized platforms or third-party services" handling government data, rather than a direct compromise of core systems. ### Who Is the Chronus Group? First identified in 2021 by threat intelligence firm Recorded Future, the Chronus Group operates as a loose collective of hackers blending hacktivism and cybercrime. While some members sell stolen databases on Dark Web forums, the group has also positioned itself as a "cyberterrorism" organization, leveraging fear, uncertainty, and doubt (FUD) to amplify its claims. Despite increased activity in recent months, security researchers note that Chronus lacks a distinct technical signature, often bundling old breaches under its name to inflate its reputation. ### Mexico’s Cybersecurity Response The ATDT has revoked compromised credentials and provided incident response support to affected government agencies. However, experts warn that these measures may not be enough to address deeper systemic vulnerabilities, particularly in obsolete systems managed by third-party vendors for state-level institutions. While the initial claims suggested a major breach, no sensitive or critical data has been confirmed as exposed. Still, the incident underscores growing cyber threats in Latin America, where information stealers and credential-stealing malware reached record levels in late 2024. Mexico, in particular, faces 3,065 cyberattacks per week on average, with both cybercriminals and hacktivists increasingly targeting the region. ### Broader Implications for Latin America The breach highlights low confidence in cybersecurity defenses across Latin America, where only 30% of experts believe their governments can effectively protect against threats. While the ATDT’s transparency in downplaying the breach could help maintain public trust, further scrutiny will determine whether the leaked data poses long-term risks, such as identity theft or fraud. For now, the incident serves as a reminder of the persistent threats to public-sector digital resilience, particularly as hacktivist groups continue to exaggerate breaches for notoriety.