SAT, IMSS and Morena breach exposes data on 36 million people: what to do today with the payroll, RFC and tax mailbox of your Mexico operation

On October 3, 2026, El Universal reported, in Spanish, a cyberattack on SAT, IMSS and Morena that exposed data on 36 million people. SAT is the Mexican tax authority, IMSS is the social security institute and Morena is the governing party. If your company has staff registered in Mexico, and any legal operation does, their tax ID, national ID number, social security number, salary and home address are probably in that package.

You cannot undo the leak. What you can do is get ahead of what follows: emails and calls that will sound very convincing because they carry real data. Here is what we would do this week, from both the Mexico office and headquarters.

What leaked and why it matters to a foreign employer

Three acronyms you will keep seeing. RFC is the tax ID, and both companies and people have one. CURP is the national ID number. NSS is the IMSS social security number. Each alone is not much. Together with salary and address, they let a stranger write to your Mexico bookkeeper and sound like the authorities.

Exposed data	What a scammer does with it
RFC and name	Fake SAT emails with the correct tax ID in the subject
CURP and NSS	Impersonating an employee to HR or payroll
Salary	Picking which employee or manager is worth the effort
Home address	Official-looking calls and letters

The extra risk for a foreign employer is structural. The people approving payments sit in another country, read Spanish so-so, and trust whatever the local accountant forwards. That gap is exactly where this kind of fraud lives.

What comes next: four frauds to expect

Phishing with real data. An email claiming to come from SAT, with the right RFC, warning about a discrepancy in a filing and offering a link to fix it. Or a call to an employee who hears their own NSS read back before being asked for something.

The employee who changed banks. HR or headquarters payroll gets an email, apparently from a Mexican employee, asking to send salary to a new account. CURP attached to look legitimate. In our experience this is the fraud that hurts most, because it arrives Friday evening across a time zone and nobody calls to confirm.

Fake invoices and CFDI. A CFDI is the electronic invoice validated by SAT. Expect suppliers that suddenly changed accounts and invoices issued against your RFC that nobody ordered.

Attempts on the tax mailbox and IDSE. The buzón tributario is the official SAT channel with your company. IDSE is the IMSS employer portal for hiring, terminations and payments. Whoever gets in can deregister staff, change your fiscal address or read notices before you do.

Checklist for this week

1. Tell your Mexico staff today. A short message in Spanish: there was a leak, expect messages that look like SAT or IMSS, do not click, report it.
2. One rule for HR, finance and HQ payroll. No bank account change for an employee or supplier is accepted by email. Confirm by phone to the number already on file, with two approvers.
3. Turn on 2FA where it is missing. Two-factor authentication is the code on the phone at login. Email, banking, payroll software and the SAT portal.
4. Find out who holds the e.firma. It is the company digital signature certificate: two files plus a password. Usually your Mexican accounting firm has it. Ask where it is stored and who can use it. It should not sit in a shared folder or an inbox.
5. Review access to SAT and IMSS portals. Rotate the tax mailbox and IDSE passwords and remove whoever no longer needs to be there.
6. Watch the email. Forwarding rules nobody created and logins from unexpected countries are the two signs someone is already inside.

What we do within the support plan

None of this requires buying a new system. Within an IT support plan we review access and email, run a short anti-phishing session for the Mexico team in Spanish, deploy EDR (modern endpoint protection that watches behavior, not just known files) and verify that backups actually restore. mundotech.news reported the same day that Mexican companies are tightening security after a surge in attacks. This is what that looks like for a 40-person office.

Let’s talk

And in your Mexico operation?

If you do not know today who holds the e.firma or how many people can log in to IDSE, that is where to start.

Book a free assessment — we reply the same business day.