Mexico investigating 12.9 million personal records offered on Telegram

On 24 September 2026, Mexico’s Secretaría Anticorrupción y Buen Gobierno (SABG) issued an official statement confirming it had found a Telegram post dated 22 September 2026. In that post, a user offered databases supposedly from various call centers, with more than 12.9 million records. SABG said those records would include full name, email address, phone and mobile numbers, date of birth, RFC (Mexico’s tax ID), home address and banking details, among other information.

SABG obtained a sample of 13,000 records from 13 databases. Brand names that appeared in that sample were Amazon, American Express, Afirme, Banamex, Banco del Bajío, BBVA, Banorte, Banregio, HSBC, Inbursa, INVEX, Liverpool, Sam’s Club, Santander, Scotiabank, Sears, Suburbia, Banco Walmart, Credomatic, IXE, Sanborns, C&A and Soriana. The secretariat said it will analyse the sample and open investigations. It did not say the 12.9 million records are genuine, that they came from those companies, or that any company was breached. As of 25 September 2026, none of those companies had issued a public statement.

The brand names are not the part that matters

Coverage of this has led with Amazon, BBVA, Liverpool and “12.9 million.” That framing makes it sound as if your bank or your store was hacked, and as if that huge number is a counted fact. SABG did not say either of those things. Its statement is full of “possible,” “alleged” and “supposedly.” A Telegram user claimed to be selling call-center databases. Investigators copied a sample of 13,000 records, and those commercial names showed up. A logo in a seller’s sample is not a confirmed breach of that company. The 12.9 million figure is the seller’s claim, not a total SABG has verified. Mexican outlets have been repeating the government comunicado, not independently checking the files.

What that misses, if you are an ordinary customer, is the mix of fields. Full name, RFC, date of birth, home address, phone numbers and banking details are the same answers a call center already asks for before it will treat a caller as you. If even some of those rows are real, a stranger does not need to break into your bank. They can phone the same kind of help line and already know the questions that were supposed to keep them out. Whether the data sat at a household-name company or at a contractor you never chose is a later legal question. For you, the live risk is impersonation with a file that looks like a customer-service identity check.