Mexico's cyber plan puts the phone number in 2026 and the scoreboard in 2030

Insikt Group's count is the number to budget against. 223 documented ransomware incidents in Mexico from January 2020 through April 2026 works out at about three a month across 76 months ^[14][19]. The more instructive figure is the ratio inside it: 223 incidents against slightly more than 100 victims, roughly two hits per named organisation ^[14][20]. Ransomware is the dominant category in the assessment, with government, manufacturing, IT and food and beverage absorbing most of it ^[18][15]. A first incident in Mexico has not bought immunity from the second.

The Plan's sequencing explains why that repeat rate is unlikely to move soon. Everything a breached company could actually call sits in one year: the 2026 Expansion Phase has to deliver a General Cybersecurity Law, stand up a National Cybersecurity Operations Center, and integrate the federal CSIRTs ^[4]. What follows is deepening rather than response capacity. A national cyber range for red and blue team exercises in 2027 ^[5]. AI in cyber defence and a regional response centre in 2028 ^[6]. An export posture for Latin America and the Caribbean in 2029 ^[7]. A permanent Cybersecurity Observatory in 2030 ^[8]. The instrument meant to track incidents arrives four years after the year that has to produce the responders ^[21].

Recorded Future does not oversell this. Its own assessment is that it remains uncertain whether the government can build the institutions the risks demand ^[1], and that earlier attempts at national cyber policy failed to gain traction ^[11]. The change it points to is political rather than technical: President Sheinbaum's administration has committed to full implementation across her term, with her party holding a majority in Congress ^[12].

That leaves the index problem. Mexico is Tier 2 in the ITU's 2024 Global Cybersecurity Index, in company with Canada, Ecuador and Uruguay, behind Tier 1 United States and Brazil ^[9]. The same source records that cyber experts nonetheless read Mexico as lagging international standards on institutional capacity-building, with international cooperation flagged as needing growth ^[10]. The 2025 Foundation Phase moved on that second point through LAC4 membership and a memorandum of understanding with Brazil ^[3]. Neither produces an on-call responder.

This lands on foreign operators rather than on Mexican agencies alone because the attributes drawing state-sponsored attention are the attributes that put the subsidiary there. Insikt Group's read is that deep integration into US supply chains, a nearshoring-linked manufacturing base and underdeveloped cyber governance make the country attractive to foreign operations ^[16]. The cited activity includes Chinese state-sponsored TAG-141 deploying SparrowDoor at Universidad Nacional Autonoma in early 2025, TGR-STA-1030 observed against at least 70 government and critical infrastructure organisations, and North Korean remote IT-worker schemes reaching Mexican entities ^[17].

Recorded Future frames the post-tournament period as the opening for real implementation, the 2026 World Cup having served as a high-profile stress test ^[13]. The defensible planning assumption for 2026 through 2028 is the one the Plan's own calendar implies: state response capacity is a legislative outcome, not an existing service ^[4].