The phrase I’ve heard most this year in meetings with CEOs is some variant of this: “we’re not an interesting target.” Logistics companies, firms, service operators and restaurant chains say it. People who assume ransomware is a problem for banks and hospitals.
This year’s first-half data says otherwise, and says it quite clearly.
How big is the problem in Mexico?
SCILabs, Scitum’s threat intelligence unit, published its regional report a few days ago. In the first half of 2026, 290 ransomware incidents were recorded in Latin America, 25.54% more than in the previous period.
Mexico ranked second in the region with 17.93% of cases, behind only Brazil, which accounts for 25.17%. Translated into companies, that is about 52 Mexican organizations hit by ransomware in six months. Two per week, counting only the ones that became known.
That number alone doesn’t keep me up at night. The next one does.
The hardest-hit sector is not the one you think
| Sector | Share of attacks |
| Services | 19,66% |
| Government | 11,72% |
| Manufacturing | 8,28% |
Services tops the list, eight points ahead of government. That includes consulting firms, logistics, private healthcare, professional firms, technology companies and tour operators. Companies that for the most part don’t consider themselves targets and therefore invest less in monitoring than a bank does.
And that is exactly why they top the list. They aren’t attacked more because they are worth more. They are attacked more because they cost less to attack.
Ransomware stopped being a craft years ago. Today it is a business that seeks margin, and the margin is where the defense is cheapest to beat. A firm with forty employees that bills well and has no one watching after hours is, in business terms for the attacker, a better customer than a bank with a thirty-person security team.
Fifty variants, but three do almost everything
The report identified 50 active variants in the region. It sounds like chaos, but it isn’t: three families accounted for 47.59% of the activity. The Gentlemen with 49 attacks, Qilin with 46 and LockBit 5.0 with 43.
This is bad news and good news at the same time. The bad news is that these three groups are professional and operate with affiliates, so their capability doesn’t depend on a single person. The good news is that, if almost half of the attacks come from three known families, their methods are documented. How they get in, what they look for first, how long they take to move. That can be monitored.
Defending against a predictable enemy is much cheaper than defending against an unknown one. The problem isn’t that no one knows what they do. It’s that almost no one is watching when they do it.
What would I do if I ran a services company?
I’m not going to give you a ten-point list. I’m going to give you three questions, and if all three have an answer, you’re better off than most.
Who watches your systems on a Sunday at three in the morning? If the answer is no one, you already know what your window is. The groups operating in the region know it too.
How long would it take you to notice? Not how long it would take you to recover; that comes later. How long it would take you to find out. It is a measurable figure and almost no one has it.
Where would they get in if not through you? Because in half of the cases the attack doesn’t come in through the company’s own door, but through that of one of its vendors.
If you want the technical work behind those answers, the guide on how ransomware operates explains it in detail, and CISA’s guide is the most serious public reference available.
None of those 52 companies considered itself an interesting target. You never get to decide what is interesting.
