Mexico investigating 12.9 million personal records offered on Telegram

On 24 September 2026, Mexico’s Secretaría Anticorrupción y Buen Gobierno (SABG) issued an official statement confirming it had found a Telegram post dated 22 September 2026. In that post, a user offered databases supposedly from various call centers, with more than 12.9 million records. SABG said those records would include full name, email address, phone and mobile numbers, date of birth, RFC (Mexico’s tax ID), home address and banking details, among other information.

SABG obtained a sample of 13,000 records from 13 databases. Brand names that appeared in that sample were Amazon, American Express, Afirme, Banamex, Banco del Bajío, BBVA, Banorte, Banregio, HSBC, Inbursa, INVEX, Liverpool, Sam’s Club, Santander, Scotiabank, Sears, Suburbia, Banco Walmart, Credomatic, IXE, Sanborns, C&A and Soriana. The secretariat said it will analyse the sample and open investigations. It did not say the 12.9 million records are genuine, that they came from those companies, or that any company was breached. As of 25 September 2026, none of those companies had issued a public statement.

The brand names are not the part that matters

Coverage of this has led with Amazon, BBVA, Liverpool and “12.9 million.” That framing makes it sound as if your bank or your store was hacked, and as if that huge number is a counted fact. SABG did not say either of those things. Its statement is full of “possible,” “alleged” and “supposedly.” A Telegram user claimed to be selling call-center databases. Investigators copied a sample of 13,000 records, and those commercial names showed up. A logo in a seller’s sample is not a claimed breach of that company. The 12.9 million figure is the seller’s claim, not a total SABG has verified. Mexican outlets have been repeating the government comunicado, not independently checking the files.

What that misses, if you are an ordinary customer, is the mix of fields. Full name, RFC, date of birth, home address, phone numbers and banking details are the same answers a call center already asks for before it will treat a caller as you. If even some of those rows are real, a stranger does not need to break into your bank. They can phone the same kind of help line and already know the questions that were supposed to keep them out. Whether the data sat at a household-name company or at a contractor you never chose is a later legal question. For you, the live risk is impersonation with a file that looks like a customer-service identity check.

You should also not expect a clean answer to the question that feels most urgent: whether you were in this. SABG has a sample, not a public list. There is no reliable way for you — or for any website — to check whether your details were in this specific offer. A “not found” result would not mean you were absent. Anyone who claims they can look you up in this incident is offering false comfort.

What to actually expect

• You are unlikely to get a personal notice telling you that you were, or were not, included. SABG has not declared a claimed breach, and as of 25 September 2026 none of the 23 named companies had spoken publicly.
• Headlines will keep repeating “12.9 million” and the same company list. That is the 24 September statement being copied, not new proof that the files are real or complete.
• If some of the data is genuine, the near-term harm is not every account emptying at once. It is tailored phone calls and messages that already know your name, RFC, birthday, or a bank or store you use — including fake contacts that pretend to be about this investigation. The aim is to pass as you, or to talk you into handing over one more code.
• SABG said it will study the 13,000-record sample and investigate alleged responsibility. That work will take time and may never produce a public, person-by-person result.

What you can and cannot fix

If your RFC, date of birth, full name or a home address of yours is in a file that was offered for sale, that copy cannot be pulled back. An RFC is not replaced. A date of birth does not change. An address you used remains a fact about you. The Telegram post existed; SABG already has a sample. Nobody can honestly promise to delete this.

• Treat inbound calls and chats that already have your RFC, birthday, address or bank as hostile. Hang up. Call back on the number on your card, app or statement. That is the point of this alleged file: to make a stranger sound informed enough to pass as you.
• Watch accounts you hold with any of the named banks and retailers for new credit, a changed phone or email on file, or transfers you did not make. Say something if it looks wrong — not because those firms have confirmed a breach, but because in Mexico a name plus RFC plus date of birth is often enough to start paperwork in someone else’s hands.
• Change what can still be changed: passwords, and how you approve logins. Phone numbers were among the fields in the offer, which makes codes sent by text a weaker lock. Prefer the bank’s own app to approve access where that exists.
• Shrink the public listings that can be bolted onto a leaked row. A bare record with your name, RFC and address becomes much more useful when it is joined to people-search pages that add relatives, extra phones, employers and previous addresses. Those listings, unlike the leaked file, can actually be taken down. That is the lever that still exists.