Mexico ransomware task force backs national disruption campaign

Mexico’s Ransomware Task Force has endorsed a set of recommendations aimed at helping government, industry and civil society reduce ransomware risk. The group wants a public-private push to disrupt criminal infrastructure, improve readiness and speed response as attacks remain a growing threat to economic and national security.

Why it matters: - Ransomware is a growing threat to Mexico’s economic and national security. - The task force says the recommendations are designed as a cohesive set of actions, not isolated steps. - The goal is to strengthen Mexico’s resilience through cooperation across government, business, civil society and academia.

What happened: - More than 40 members of the México Ransomware Task Force endorsed actionable recommendations for the Mexican multistakeholder community. - The recommendations were finalized after months of preparatory work and a day-long conference at Mastercard’s Mexico City office. - The task force is led by the non-profit Institute for Security and Technology with global and local partners. - The effort follows IST’s earlier Ransomware Task Force, which produced 48 recommendations in 2021 for the U.S. and global response to ransomware. - IST says it has seen preliminary or significant progress on 91% of those earlier recommendations.

The details: - The task force organized its work around four goals: deter ransomware attacks, disrupt the ransomware business model, help organizations prepare and improve response. - Working groups were chaired by FTI Consulting and a civil society member for Deter; Chainalysis and Mastercard for Disrupt; Microsoft and Scitum for Prepare; and Delta Protect for Respond. - Participating organizations included AMITI, Bitso, Capa8, CrowdStrike, Delta Protect, GNP Seguros, KIO IT Services, Mifel Bank, the Technological Institute of Monterrey, the Mexico office of the United Nations Office on Drugs and Crime, the Secretariat of Security and Citizen Protection, and the University of Guadalajara. - Recommendations affirmed during the conference include reinforcing national accountability measures and attribution capabilities, launching a national campaign to disrupt criminal infrastructure, developing a public awareness plan for ransomware readiness, and publishing an executive guide for ransomware response. - The group also wants a national repository of resources for use in ransomware attacks. - The recommendations are available in the task force’s full announcement.

Between the lines: - The focus on criminal infrastructure suggests the group sees prevention and disruption as important as victim response. - The mix of government, private sector and academic participants points to a strategy built around coordination rather than a single agency response. - The plan mirrors a broader model IST has already used in the United States, where it says earlier recommendations moved from concept to implementation in many cases.

What’s next: - Working group co-chairs and members will start implementation steps as the formal México Ransomware Task Force process continues through the end of 2026. - IST and the working group co-chairs plan to publish a report in November 2026 with more detail on the recommendations and implementation paths. - IST said the partnerships built through the task force are expected to continue after the formal process ends.

The bottom line: - Mexico’s ransomware response effort is shifting from discussion to execution, with public awareness, criminal disruption and practical preparedness at the center of the plan.