Mexico's Cybersecurity Plan Faces World Cup

Mexico's New Cyber Plan Meets the World Cup Stress Test

Mexico's Plan Nacional de Ciberseguridad 2025–2030 was designed on paper. The FIFA World Cup, an AI-driven breach of nine agencies, and 9,741 fake domains are the audit.

Mexico launched its National Cybersecurity Plan on December 4, 2025 — 189 days before the FIFA World Cup opened in the Estadio Azteca — and the tournament has already exposed the gap between roadmap and defense: an AI-augmented intrusion into nine Mexican federal agencies, roughly 13,000 tournament-themed phishing domains registered in the first five months of 2026, and a plan that still lacks a cybersecurity law, a functioning National Cybersecurity Center, or minimum controls for the vendors running critical infrastructure. The winners of that gap are not state adversaries but for-profit cybercriminals operating overseas, cloning FIFA and Mexican bank sites at industrial scale while President Claudia Sheinbaum's team races to stand up institutions the plan only promises.

What Mexico Actually Adopted — and What It Still Doesn't Have

The Plan Nacional de Ciberseguridad 2025–2030 was drafted by the Agencia de Transformación Digital y Telecomunicaciones (ATDT), a new cabinet-level body created by a November 28, 2024 reform to the Ley Orgánica de la Administración Pública Federal. Its cybersecurity arm, the Dirección General de Ciberseguridad (DGCiber), was formally granted authority to design, audit and enforce federal cybersecurity policy under the Reglamento Interior published in the Diario Oficial, signed by Sheinbaum under Article 89 of the Constitution. On December 17, 2025, ATDT followed with the Acuerdo emitting the Política General de Ciberseguridad — the binding cybersecurity policy for the federal executive branch. That is real, primary-source progress. It was also overdue: the Carnegie Endowment concluded in a 2024 study that Mexican cyber policy had "stalled under AMLO," with spending controls cancelling cyber budgets even as ransomware volumes climbed.

The bad news is what the plan does not yet include. As Recorded Future's Insikt Group notes in its June 2026 evaluation, the document "does not create new cyber policies or legal frameworks" — it sets benchmarks toward them. Mexico still has no general cybersecurity law: on January 13, 2026, Diputada Ivonne Ortega introduced an initiative to amend Article 73 of the Constitution simply to give Congress the express power to legislate on the matter, with a 180-day deadline for a Ley de Ciberseguridad after enactment. Mexico is also not yet a party to the 2024 UN Convention against Cybercrime; the Comisión Permanente formally exhorted the executive branch in June 2025 to explain the delay, noting the country remains an "observer" while cybercrime cost the state real money — ransomware attacks in Mexico grew more than 4% in the first half of 2024 alone, and phishing volumes rose 220%.

The country's own diagnostic is unforgiving. ATDT's Programa Sectorial 2025–2030, also filed in the Diario Oficial, records 187 billion attempted cyberattacks against Mexico in 2022 — the highest total in Latin America, per Fortinet data — and ranks the country 62nd in the 2025 National Cybersecurity Index, behind the Dominican Republic (30), Brazil (31), Chile (42), Uruguay (43), Argentina (49), Panama (50), Costa Rica (58) and Jamaica (60). That is the peer group Sheinbaum's plan is trying to leapfrog while the tournament plays. A separate January 2026 congressional proposición documents why the deadline matters: in 2025 alone, IMSS records covering "nearly half the population" were siphoned off, and the personal data of roughly 20 million retirees were offered on dark-web markets, alongside Infonavit records and state-level C5 command-centre databases.

The First Test Was Not the Tournament — It Was Claude

Before the first ball rolled on June 11, 2026, Mexico had already lost a round. In a technical incident dated late 2025 to early 2026 and analysed by CSIS's Strategic Technologies program, a single operator breached nine Mexican federal agencies using Anthropic's Claude Code and OpenAI's ChatGPT to automate reconnaissance across hundreds of servers. CSIS reports the shift from Claude refusing the reconnaissance request to a jailbroken, live-executing agent took just 40 minutes — "further compressing the timeline for defenders." Crucially, CSIS describes the operator as "a single capable operator," not a state team; the AI compressed exploit iteration and let one person "punch well above what they could have without AI."

The intrusion "harvested data but failed to affect operational-technology systems," according to a July 9, 2026 Dark Reading analysis — cold comfort, because OT is precisely what stadium turnstiles, transit signalling and municipal water systems run on. José Felipe Otero, an adjunct professor at New York University specialising in Latin American telecom infrastructure, told Dark Reading the plan "does not outline concrete measures to assess third-party risks, implement software bills of materials (SBOMs), or require minimum controls from technology providers." He added that the plan's focus on small and medium-sized enterprises "is limited, even though they represent the majority of the national economy and are an essential part of global supply chains." That is a load-bearing omission: the World Cup's soft targets — fan zones, transit corridors, ticket-scanning networks, hospitality Wi-Fi — sit on vendor stacks the DGCiber cannot yet audit.

The AI breach also reframes the threat model the plan was written against. Recorded Future's baseline threats — ransomware, financial malware, hacktivism — assumed nation-state actors were the ceiling of sophistication. A single operator with two commercial LLM subscriptions punched through nine federal networks. And the historical precedent is worse than a one-off: the 2022 Guacamaya leak of six terabytes of SEDENA emails, the 2022 SICT ransomware attack, the 2023 BlackByte attack on CONAGUA, and the 2024 RansomHub attack on the Legal Counsel's Office of the Presidency form a pattern Recorded Future describes as "fragmented, uncoordinated national response capacity." The plan's premise — that Mexico can build capacity to a 2030 finish line — assumes attackers stand still while it does.

Plan Kukulkán Is a Physical-Security Doctrine Dressed in Cyber Language

Mexico's operational answer to World Cup risk is Plan Kukulkán, named for the Mayan serpent deity and unveiled by Sheinbaum on March 6, 2026. As BBC Sport reported, it deploys "just over 99,000 personnel" across the three host cities — 20,000 military, 55,000 police, the rest private security — plus 2,500 vehicles, 24 aircraft, anti-drone systems and explosive-detection dogs. The announcement came two weeks after the February 22, 2026 army operation that killed Jalisco New Generation Cartel leader Nemesio "El Mencho" Oseguera and triggered cartel unrest in Guadalajara, one of the three Mexican host cities; Al Jazeera reported that General Roman Villalvazo Barrios framed the deployment as answering "two challenges: to present a reliable and secure country before the international community, and to have the capacity to confront any threats that undermine national security."

Almost none of that addresses the actual cyber threat surface. The most exhaustive open-source assessment, CSIS's June 2026 analysis, ranks cybercrime — not state disruption — as the primary danger to fans and Mexican organisations, citing Canadian Centre for Cyber Security warnings that "1,000 suspicious domains" were staged in advance and that "Chinese cybercriminals" had cloned FIFA's website across 300 domains. Threat-intelligence firm Silent Push has catalogued more than 300 "pixel-perfect replica ticketing websites"; Check Point Research counted 9,741 fraudulent World Cup domains registered in April 2026 alone, per ACI Worldwide's June 18 disclosure — roughly four times the peak of the 2022 Qatar tournament. Fortinet logged more than 13,000 tournament-themed domains between January and May. The FBI's May 27, 2026 public service announcement warned fans to type fifa.com directly rather than click search results. None of these domains will be taken down by 100,000 troops in Guadalajara.

Mexico's second-order exposure runs through Washington. CSIS's companion terrorism assessment notes the 76-day U.S. Department of Homeland Security funding shutdown in spring 2026 delayed host-city grant funding and stripped roughly a third of CISA's staff — the U.S. agency Mexican counterparts had been counting on for information-sharing under the Kukulkán framework. The Transportation Security Administration, slated to screen fans at stadium entrances in addition to its airport duties, lost nearly 8 percent of its workforce during the same shutdown. Mexico's plan explicitly leans on cooperation with the U.S., Canada and FIFA; a hollowed-out CISA means DGCiber — which has existed as a functional entity for barely a year — is picking up more of the load than its 2025 designers assumed. The UK government has been reduced to warning its own fans directly, with Lloyds Bank documenting a 36% jump in football-ticket scams during the 2025–2026 Premier League season — a signal that consumer-side education is doing work national frameworks are not.

Who Wins, Who Loses

The immediate beneficiary of Mexico's implementation gap is transnational cybercrime — the phishing rings running the 300 cloned FIFA sites, the ransomware affiliates targeting IMSS and Infonavit, and the Chinese money-laundering networks that Recorded Future links to Mexican drug-trafficking organisations through crypto and cybercrime-as-a-service procurement. The immediate loser is not the Sheinbaum administration's political capital — the World Cup will end and the plan will continue — but Mexican small and medium-sized enterprises, which Otero flagged as absent from the plan and which Mexican industry data suggest carry the highest ransomware exposure. Sixty percent of Mexican firms hit by ransomware never fully recover operations and 25% close within six months, according to figures cited in a March 2026 guidance note hosted on a Mexican municipal government domain.

The historical parallel worth watching is 2017. Mexico's first National Cybersecurity Strategy (ENCS), published under Enrique Peña Nieto, was never fully implemented; the Australian Strategic Policy Institute noted it was not published in the Diario Oficial, and Carnegie called its follow-through "a missed opportunity." Sheinbaum's team has done what Peña Nieto's did not — publish binding instruments in the DOF, create a cabinet-level agency, name specific 2026 deliverables. The question is whether legal instruments and 99,000 boots can compensate for missing OT rules, missing vendor requirements, and a National Cybersecurity Center that will not exist until the tournament is over.

What to Watch Next

• Q3 2026: ATDT is due to publish the Estrategia Nacional de Ciberseguridad, the operational sequel to the plan; timing overlaps with post-tournament forensic reviews.
• Late 2026: Stand-up of the National Cybersecurity Center, the plan's coordination hub. Delay past year-end would be the single clearest signal of implementation slippage.
• 180 days after any enactment of the Ortega constitutional amendment: deadline for a general Ley de Ciberseguridad, without which the DGCiber's binding authority stops at the federal executive.
• Post-tournament IMSS / Infonavit disclosures: whether the 2025 breaches are followed by tournament-window intrusions will indicate whether Kukulkán's information-sharing with CISA and the RCMP delivered any cyber value.

Diplomat View

The forecast: Mexico's National Cybersecurity Plan will survive the World Cup because the plan's success criteria for 2026 are institutional, not operational. ATDT will publish its Estrategia; the National Cybersecurity Center will open, likely late; the DGCiber will claim credit for detecting rather than preventing intrusions. The falsifying condition is a stadium-adjacent OT incident — a transit signalling failure in Mexico City, a ticket-scanning outage in Monterrey, a payments freeze in Guadalajara — that traces back to a vendor DGCiber had no authority to audit. If that happens, Otero's SBOM critique becomes the post-mortem finding, and the Ortega constitutional amendment accelerates. If it does not, Sheinbaum banks the tournament as validation and the 2030 timeline holds. Watch the vendors, not the troops. The AI-augmented breach of nine agencies has already told us where the 2027 headline will come from; the only question is whether Mexico writes the rules for third-party risk before the next operator, with the next model, does the same job in 20 minutes instead of 40.