A cyberattack can leave your Bajío operation unable to invoice for months: how to protect CFDI, the accounting system and digital seal certificates (CSD)

On October 8, 2026, Periódico AM reported that a cyberattack can leave companies in Guanajuato unable to invoice for months. The same day, El Sol de México noted that small businesses in the state know they need cybersecurity but have no specialists.

If you run a plant or warehouse in León, Silao, Celaya or Querétaro, this matters more than it sounds. In Mexico every sale needs a CFDI, the electronic invoice stamped for the tax authority (SAT). No CFDI, no payment. And your local finance team is often two or three people with no IT backup on site.

Where your CSD and e.firma live

The CSD (digital seal certificate) is a pair of files, .cer and .key, used to seal every invoice. The e.firma is the company’s advanced electronic signature: same format, but it unlocks every SAT procedure, so it is even more sensitive.

In our experience, at many Mexico sites those files sit on the local controller’s desktop, on a USB drive in a drawer or in an old email. Head office rarely knows where. If that PC gets hit by ransomware (malware that encrypts your files and demands payment), they go with it.

Asset	Where it usually is	Where it should be
CSD and e.firma	A desktop folder or a loose USB drive	Encrypted vault plus an off-site copy HQ can reach
PAC portal login	One user shared by the whole finance team	One user per person, with MFA
CONTPAQi, Aspel or ERP database	A single server at the plant	Daily backup, off-site copy, monthly restore test
Issued and received XML files	A folder on the server	Backed up separately; SAT also keeps them

Who can log in to the PAC and the accounting system

The PAC is the authorized certification provider: the company that stamps your invoices with SAT. Ask your local team how many people know that login. If the answer is “everyone in finance”, fix it this week.

Same for CONTPAQi, Aspel or the local ERP instance. One user per person, role-based permissions, MFA (a second code on the phone) wherever possible, and same-day removal when someone leaves. We covered what happens when that step is skipped.

Backups that bring the books back

XML files can be downloaded again from the SAT portal. The accounting database cannot: journal entries, reconciliations and customer balances live there. Lose it and someone re-keys months of work.

Backups should be automatic, daily, with one copy ransomware cannot reach (offline or immutable, meaning nobody can change or delete it) and, above all, tested. More in backups that actually restore.

Invoicing from another device if the server goes down

Most PACs offer a web portal to issue invoices from any browser, and SAT runs a free invoicing service. With the CSD at hand and a clean laptop, your Mexico team keeps invoicing while the server is offline.

The catch: test it now. Issue one invoice from that laptop this month, not on the day of the attack.

A 48-hour plan to keep invoicing

When	What to do
First 4 hours	Isolate affected devices, call your IT provider, notify HQ, do not pay ransoms
Up to 12 hours	Bring out the backup laptop and reset PAC and email passwords
Up to 24 hours	Issue urgent invoices from the PAC or SAT portal
Up to 48 hours	Restore the accounting database on a clean machine and reconcile Plan B invoices

Let’s talk

What about your Mexico operation?

Three questions for your local team: where is the CSD today, when was the accounting database last restored, and from which other machine would you invoice tomorrow?

At ProcessBi we build support plans with tested backups, endpoint protection and field support in León, Irapuato, Celaya and Querétaro, in English or Spanish, invoiced in MXN or USD. Every plan starts with a free assessment.

Book your free assessment — we reply the same business day.