Mexico ranks among the countries hit hardest by cyberattacks in 2022, recently released data has revealed.
In the first half of 2022, 85 billion cyberattacks were attempted in Mexico, according to the Mexican Cybersecurity Association (AMECI), an increase of 40% over the same period in 2021.
The global cybersecurity company Fortinet said that from January to June, Mexico suffered more cyberattacks than some of the biggest targets in Latin America, including Brazil (at 31.5 billion) and Colombia (6.3 billion). Fortinet noted that many attacks used sophisticated and targeted strategies such as ransomware.
Mexico had the region’s highest ransomware distribution activity in the period, with more than 18,000 detections, according to Fortinet, followed by Colombia (17,000), Costa Rica (14,000), Peru, Argentina and Brazil.
Hackers have targeted both companies and federal and state governments in Mexico. The online sales platform Mercado Libre, for example, announced in March that a hack had compromised data of 300,000 customers in Mexico and Latin America. A number of sites belonging to state agencies in Jalisco have been targeted for cyberattacks since December 5.
After a cyberattack on October 24, Mexico’s Ministry of Infrastructure, Communications and Transport suspended a range of bureaucratic procedures and other work for the rest of 2022. And in September, President López Obrador acknowledged that tens of thousands of emails stored in the Defense Ministry (Sedena)’s servers, containing communications from 2016 to September 2022, had been hacked and released to journalists by the Guacamaya hacktivist group.
Michal Salát, director of threat intelligence at Avast, an international cybersecurity company that operates in Mexico, told Excelsior that cybercrime is on the rise due to several factors — the most crucial being that malicious, open-source code is easily available on public platforms.
This means, he noted, that even those with basic tech knowledge can acquire malware and be more inclined to “join the dark side.” He also said criminal groups have been recruiting and paying people to carry out denial-of-service attacks or install ransomware on their employers’ devices.
Salát stated that ransomware attacks have been “a nightmare” for companies and individuals in 2022, especially when cybercriminals threaten to make their targets’ data public if a ransom is not paid.
According to IBM, the average cost to a company suffering a cyberattack, one in which significant and wide-ranging disruption occurs, was US $2.1 million dollars in 2022 — an increase of 15% over 2021.
Moreover, 60% of the companies affected increased the price of their services after a data leak, IBM added in its Latin American Perspectives report, which also stated that phishing is the most common tactic used by cybercriminals.
Phishing is carried out by infiltrating networks by impersonating companies or people who are credible in order to convince individuals to voluntarily provide personal information such as passwords, bank information or other data. It is different from cyberattacks in that it uses spam emails, texts or social media platforms to attempt to steal passwords and/or data from individual users.
In regard to those types of attacks, a Mexican non-governmental agency this week issued recommendations on how to deal with cybertheft aimed at individuals.
The National Institute for Transparency, Access to Information and Protection of Personal Data (INAI) said the best thing people can do is that, when receiving emails from well-known institutions such as banks, look at the email address and verify that it is valid (fraudsters often use emails similar to the originals, but there will usually be something amiss).
The institution also urged not to provide personal information when answering an email, text message or phone call, and to use official websites or social media channels when contacting an institution or company.
“You should avoid opening unverified email attachments, as they may contain viruses,” the INAI said, adding that it is important to change passwords from time to time, as that decreases the chances they can be obtained by outsiders.
Also, the agency noted, “practice ego surfing from time to time. This action consists of using social networks and search engines to locate information about ourselves on the internet, in order to verify that there are no false profiles or suspicious activities.”
