IMSS Hack Exposes 20 Million Pensioners’ Data

Mexico City — A new blow to institutional cybersecurity has exposed the fragility of the systems at the Mexican Social Security Institute (IMSS), after a hacker group identified as Sc0rp10nn leaked and offered for sale on the dark web a database containing confidential information of more than 20 million pensioners.

The database, approximately 1.4 gigabytes in size, contains personal data such as names, CURP identification numbers, addresses, social security numbers, blood types, and even medical histories.

According to cybersecurity specialists, this information is being sold for 50,000 pesos or to the highest bidder on clandestine internet forums. Although the IMSS denied having been hacked, it acknowledged, via an informational brief, that a leak may have occurred through the misuse of institutional access by internal personnel, for which several lines of investigation remain open.

Cybersecurity expert Erick Gómez Villaseñor, who has been monitoring the responsible group, confirmed the authenticity of the attack after validating samples of the published data. He warned that the exposure of these records represents a real risk of extortion, identity theft, and even crimes such as organ trafficking, due to the inclusion of sensitive medical information.

This is not the first security breach faced by the IMSS. So far this year, at least three hacks have been documented, one of which involved the theft of 56 million records. Furthermore, unauthorized access to the IMSS-Bienestar program database was recently reported, including the medical records of aspiring doctors, with extremely personal details.

A lack of robust protocols, specialized personnel, and a clear strategy for cyber defense has left the institute as a frequent target for cyberattacks, according to analysts consulted. Despite the warnings, institutional reactions have been delayed and limited. Meanwhile, the data of millions of beneficiaries continues to circulate on the deep web, without an effective response from the authorities to stop these violations that compromise the security and privacy of millions of Mexicans.