CFE denies new data breach

Mexico’s state-owned electric power utility CFE denied reports a new breach of its network infrastructure occurred.

Germán Fernández, a Chile-based cybersecurity expert, posted initial details on the supposed breach via Twitter last week, saying, “malicious actor published [CFE] database with more than 14.6mn customer records.”

However, in a statement CFE said the supposed client data listed online did not conform to the company’s current data structure or content.

According to Fernández, the data was leaked to a site named Breachforums, and the records included meter numbers, federal tax IDs (RFC), names, addresses, municipalities and states.

He also said a separate attack compromising the records of some 26,000 clients occurred in June 2021.

CFE said its tech services coordination division CST registered possible illegal online publication of information on July 7, activating security protocols for such incidents. But the company added it controlled logs, servers and communication equipment, confirming data had not been illegally copied or altered.

Additionally, CST analyzed the data posted to Breachforums. According to the report, the data corresponds to 2003 or 2004, so the leak must have occurred at that time. The database does not consider name changes that were made after these years, CFE said.