September 29, 2026<\/p>\n\n\n\n
The potential exposure of millions of individuals\u2019 contact, tax, address and banking information may create risks of fraud, identity theft, attempted extortion and unsolicited communications. The case is relevant both to the individuals potentially affected and to companies that rely on call centers or other service providers to process personal data, as it places the security and oversight of the entire processing chain under scrutiny.<\/p>\n\n\n\n
On September 24, 2026, the Ministry of Anti-Corruption and Good Governance (Secretar\u00eda Anticorrupci\u00f3n y Buen Gobierno, \u201cSABG\u201d) announced that active monitoring had uncovered indications of a possible personal data leak and that it would analyze the information and open ex officio investigations.<\/p>\n\n\n\n
On September 22, 2026, a user not identified in the press release offered, through a messaging platform, databases allegedly attributable to various call centers, containing more than 12.9 million records that reportedly included names, contact details, dates of birth, taxpayer IDs, addresses and banking data.<\/p>\n\n\n\n
The SABG obtained a sample of 13,000 records from 13 databases associated in the post with various legal entities and trade names. That reference does not establish that those companies sold the data, directly suffered the leak or committed an infringement; those issues remain subject to investigation.<\/p>\n\n\n\n
The investigation will be conducted under the SABG\u2019s oversight and verification powers set out in Articles 39, section I, 54 and 55 of the Federal Law on the Protection of Personal Data Held by Private Parties, published on March 20, 2025, and Articles 30-B, section VII, and 30-F, section II, of the Ministry\u2019s Internal Regulations.<\/p>\n\n\n\n
The announcement shows that the SABG is using monitoring activities to identify potential noncompliance that may lead to an ex officio investigation under the procedure established by the LFPDPPP.<\/p>\n\n\n\n
For companies, the case underscores the importance of the processing chain: engaging a processor does not eliminate the controller\u2019s obligation to oversee the processing, formalize the contractual relationship and maintain security measures proportionate to the risk (Arts. 47 and 49 to 51 of the Regulations and Art. 18 LFPDPPP). If a breach significantly affects data subjects\u2019 economic or moral rights, the controller must notify them immediately (Art. 19 LFPDPPP).<\/p>\n\n\n\n
The announcement of this investigation does not mean that the SABG has determined that an infringement occurred or that any particular company is liable.<\/p>\n\n\n\n
Basham, Ringe y Correa’s Privacy and Data Protection team advises companies on LFPDPPP compliance, vendor management and security incident response.<\/p>\n\n\n\n
SABG press release, available at: https:\/\/www.gob.mx\/buengobierno\/prensa\/buen-gobierno-investiga-presunta-venta-de-mas-de-12-9-millones-de-registros-con-datos-personales<\/a><\/p>\n\n\n\n Sincerely,<\/p>\n\n\n\n Adolfo Athie
aathie@basham.com.mx<\/a><\/p>\n\n\n\n