Ransomware in Mexico: how to prepare your company before, during and after an attack?

Mexico closed 2025 among the eleven countries with the most ransomware attempts in the world, and in Latin America only Brazil receives more attacks. The trend has not slowed in 2026: during the first quarter, Mexican financial institutions were affected, with groups such as LockBit and Qilin involved. Manufacturing, healthcare, government and banking top the list of targets.

At ZetTateK we review incidents of this kind all year, some at companies that come to us after the blow. And the same pattern almost always appears: the difference between a scare and a catastrophe is not made by the attacker. It is made by preparation.

That is why we prepared this guide for any executive leadership team: what to do before, during and after a ransomware attack.

How does ransomware get into a company?

Forget the image of the genius who breaks firewalls by brute force. In real cases, the way in is usually much simpler:

• Credentials stolen through phishing: a convincing email, someone types their password where they shouldn't, and the attacker walks in with their own key.
• Exposed remote access: VPN or remote desktop published to the internet without multi-factor authentication.
• Unpatched vulnerabilities in servers and applications visible from the outside.
• Compromised suppliers: the attacker comes in through the door of a third party with access to your network.

Modern ransomware operates as a business: one group develops the tool and its affiliates use it in exchange for a commission. And for years they have applied double extortion: they encrypt your information and also steal it, threatening to publish it if you don't pay. That is why backups, while indispensable, are no longer enough on their own. If the term feels unfamiliar, here we explain what ransomware is and how it works.

Before the attack: reduce the surface and rehearse

Everything that really matters in an incident is decided months before it happens. In order of impact, this is what I review first in any company:

Access. Multi-factor authentication on email, VPN and every remote access point, with no exceptions for executives or suppliers. Most of the cases we handle would have died at this point.

Backups that restore. A 3-2-1 scheme (three copies, two media, one outside the company) with at least one immutable or offline copy, and restore tests with date and result. A backup that has never been tested is a hope, not a plan. If this part is too much for you, there is backup and disaster recovery managed.

Endpoint detection. An EDR monitored by people can stop encryption in minutes; installed with no one watching it, it only documents the disaster. Add a segmented network and least privilege: a compromised sales computer should not be able to touch production servers.

A rehearsed plan. A written response plan, with roles and backups for each role, and at least one drill a year with leadership included. As a technical reference to build it, I recommend the ransomware profile of the NIST framework, which organizes the entire cycle: identify, protect, detect, respond and recover.

During the attack: what to do in the first hours?

Suppose you wake up today to encrypted files and a ransom note. The first hours define the final size of the problem:

• Isolate, don't shut down. Disconnect the affected computers from the network (cable and Wi-Fi), but don't turn them off: live memory holds evidence that the forensic analysis needs.
• Cut off remote access and rotate privileged credentials. The attacker is usually still inside while you decide.
• Activate the plan: who decides, who operates, who communicates. A single voice toward customers and authorities.
• Preserve evidence: logs, the ransom note, disk images. You will need it for the insurer, for the criminal complaint and to understand what happened.

And paying the ransom? The position of the #StopRansomware guide from CISA and the FBI is clear: they do not recommend it. Paying does not guarantee you will recover the information, does not prevent your data from being published and funds the next attack. In Mexico there are also legal obligations if personal data was compromised: the LFPDPPP requires notifying the affected data subjects.

If you don't have people trained for this phase, this is the exact moment to call an incident response team available 24/7. Every hour of improvisation is paid for in days of halted operations.

After the attack: recover without reopening the door

Recovering is not just restoring files. Before closing an incident, in the SOC we require four things: restoring from verified backups (a rushed restore can also bring back the attacker's back door), a root cause analysis that answers how they got in, how long they stayed and what they touched, closing the entry vector, and enhanced monitoring during the following weeks. Repeat victims exist: a significant share of victims are attacked again within months, often by the same group.

Finally, an honest report to leadership: real cost, detection and recovery times, decisions made and what is going to be fixed. That document is worth more than any vendor presentation.

The CISO's list: 10 points to review this week

Print this list and review it with your IT team. Every “no” is a task with a name and a date:

1. Multi-factor authentication enabled on email, VPN and all remote access.
2. Inventory of systems exposed to the internet, with an owner and the date of the last patch.
3. EDR on servers and endpoints, with someone who actually monitors it.
4. Segmented network: critical systems separated from everyday ones.
5. 3-2-1 backups with at least one immutable or offline copy.
6. The last documented restore test, with date and result.
7. A printed response plan, with roles and phone numbers (if ransomware encrypts the server, it also encrypts the plan's PDF).
8. Defined emergency contacts: legal, forensics, insurance and authorities.
9. A ransomware drill carried out in the last 12 months.
10. A prior agreement with a 24/7 response team, in-house or external.

No company can become impossible to attack. It can become hard to extort: with backups that restore, access that holds up and a team that knows what to do in the first hour.

If you want to know where you stand today, start with the list above. And if you'd rather we review it with you, request a free security assessment: in one session we tell you what is solid and what urgently needs closing.

Frequently asked questions