5170

Chronus conducted a coordinated December 2025 campaign that breached over 20 Mexican public institutions (including the Tax Administration Service and IMSS Bienestar), using tools to infiltrate government web portals to exfiltrate personal data and deface websites. Investigators reported 26 attacks (23 data thefts and 3 defacements); Mexican authorities opened probes and the group publicly claimed responsibility via defacement messages and leaked data.