Unverified claim — July 2026: Threat-intelligence reporting flagged a cybercrime-forum post advertising 7.9 million records allegedly tied to the Government of Mexico City (CDMX). Ciudad de México had not issued a matching public breach confirmation at indexing time. Treat the row count as actor marketing until a regulator or city agency validates it.
What was advertised
Forum listings described a large citizen or taxpayer-adjacent dataset associated with CDMX government systems. Exact field types—CURP, RFC, addresses, benefit records—were not independently verified from primary samples in open reporting reviewed for this entry.
Separately, DailyDarkWeb documented early July 2026 underground posts claiming access to CDMX Secretariat of Administration and Finance (SAF) systems, citing internal repositories, databases, credentials, and taxpayer-related information. That thread may or may not be the same seller as the 7.9M advertisement; BreachHistory indexes them under one CDMX forum-claim row with the actor-cited 7.9M figure labeled unverified.
Mexico's 2026 breach background
CDMX does not exist in a vacuum. January 2026 saw the Chronus Group hacktivist wave against federal agencies; July brought World Cup tourism and a new national cybersecurity plan fighting for attention. Local government SAF systems hold payroll, vendor, and taxpayer-adjacent rows that fraud crews prize for impersonating municipal offices.
When a city of nine million people hears "millions of records," the useful question is not "is the number real?" but "what phishing template does this enable tomorrow?"
What to do if you live or pay taxes in CDMX
- Do not download forum dumps—they may contain malware and re-victimize people whose data is already exposed elsewhere.
- Skeptical of SMS or WhatsApp citing real RFC fragments or municipal fine amounts; go to cdmx.gob.mx or official apps directly.
- Enable bank transaction alerts if tax-refund or CLABE-change scams spike after forum posts.
Canonical record
Government of Mexico City 2026 forum claim on BreachHistory — unverified.
Sources: DailyDarkWeb (CDMX SAF forum claims), CDMX official site.