Hackers Leaked 50,000 Mexican Credentials on .gob.mx Sites

The worst part? Many of these passwords still work. When analyzing the file, it was found that the most affected is SAT, with 23,712 compromised logins. But it is not the only one:

1. CDMX Government: 961 accounts.

2. ISSSTE: 533 leaked passwords

3. Employment.gob.mx: 649 active combinations.

These are not just any sites. They all handle sensitive information: personal data, income, work history, medical and social services. If someone accesses that account, they can not only see your information, but also use it. The potential damage is enormous.

Read more: Hackers Infect Devices with Malware by Charging 100 Pesos

Do passwords work? Yes... and that's the big problem.

As unbelievable as it sounds, some of the leaked passwords still work. It was confirmed that at least part of the credentials are valid and were used to log into real accounts on government portals, such as ISSSTE's, where even Single Electronic Files dated May 22, 2025 were downloaded. These files are not just anything: they contain super sensitive information such as:

1. CURP, RFC, NSS, address, gender and marital status.

2. Salaries, job titles, contribution history and type of contract.

3. Family members' data (names, relationship, CURP, entitlements)

4. Assigned medical unit and ISSSTE delegation

5. Information on pensions and affiliations to FOVISSSTE

In other words, if someone with bad intentions gains access, they have everything they need to supplant you or give you a very hard time.

Where did all these passwords come from?

Although there is no official source confirmed, everything indicates that the credentials were stolen using infostealer malware. This type of malware gets into your computer or cell phone without you realizing it, and it usually does so through:

1. Downloaded files (such as cracks, fake PDFs or infected forms).

2. Cloned websites that mimic official government websites

3. Phishing campaigns on social networks

Once the infostealer is installed, it does its work silently:

1. It extracts all the passwords saved in your browser.

2. Steals session cookies (those that keep you logged in)

3. Checks and copies downloaded or saved documents

Then, the attackers put it all together in giant files like the one that was leaked, known as combolists. They share them for free to gain notoriety or attract buyers, and then sell more “valuable” assets or launch more targeted attacks. Yes, like it's a business. Because it is.

And what about SAT, is it also at risk?

The figure is frightening: more than 23 thousand accesses linked to the SAT portal. But before panicking, let's put things in context. The SAT has been updating its system and strengthening its security in recent months. Many of the web addresses that appear in the leak are no longer active or were redirected to new internal routes.

That means that, in many cases, those passwords probably no longer work directly to enter the current SAT portal. But beware: this does not render them harmless. Why? Because that data can still be very useful to attackers. For example:

1. They can use them to try to recover passwords via email.

2. They could impersonate you on other sites.

3. Or launch more personalized attacks using what they know about you (called “social engineering”).

Read more: Hacker Who Doxed Sheinbaum Leaks Data on 17 Million Mexicans

So why is this so serious?

Because we are not talking about an old leak, nor about a file “for bothering”. It is a database with real accesses, that work in several cases, and that allow to enter official platforms where there is current information and documents with legal validity. In short: it doesn't matter if a specific URL is no longer useful. If your data is there, you are still at risk.