Update: Alleged Attack on the Fiscalía General del Estado de Guanajuato
The following information is based on a statement that was sent directly to us by the Tekir APT hacking group. Please note that, at the time of writing, this claim is pending verification and has not been confirmed by the alleged victim organization.
Note: Although the threat actor offered to show us a sample of the allegedly stolen data, we refused to accept or download any such material in accordance with Hackmanac’s security and legal policies.
What Tekir APT Claims
Tekir APT claims to have gained access to, encrypted, and deleted backups of multiple subdomains linked to the Fiscalía General del Estado de Guanajuato (FGEG), including those of the attorney general’s office, the police department, municipal systems, regional infrastructure, and camera footage.
The group alleges that more than 250 GB of data was exfiltrated. They list “personal identification information, legal case files, and internal communications” as potential contents.
Tekir APT states that it will publish the stolen data unless a payment is made by November 20, 2025.
The group asserts that the FGEG’s denial of any breach reflects a lack of transparency and threatens to release further details about security systems if negotiations do not occur.
Official Response from the Fiscalía
The FGEG has publicly denied any intrusion, stating that its internal systems show no signs of compromise.
A spokesperson for the agency noted that an internal review is underway as a precautionary measure, but emphasized that "the information circulating about the alleged breach lacks validity."
To date, the FGEG has not presented any evidence of exfiltration or system compromise.
At Hackmanac, we are committed to providing our community with accurate, verifiable information. We will continue to monitor the situation and analyse any verifiable technical indicators that may emerge, and will provide updates based on confirmed and publicly available evidence.
