America Movil Listed by trigona Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to list large telecommunications firms on dark-web leak sites as part of double-extortion campaigns, a pattern that has become a routine feature of the current threat landscape. In this environment, even an unverified claim can raise immediate questions for customers, employees and partners about the security of internal systems and the data they hold.

On 25 January 2024, the ransomware group known as Trigona listed América Móvil as a victim, claiming to have exfiltrated internal files. Public detail remains limited: the number of people affected is unknown, and no further technical specifics have been released. The listing itself is a claim by the group rather than a claimed breach disclosure by the company.

What happened

According to the available record, América Móvil was listed by the Trigona ransomware group on 25 January 2024. The group asserted that internal files had been exfiltrated in a ransomware attack. No public confirmation of the intrusion method, the precise date of any compromise, the volume of data taken, or the number of individuals affected has been provided. The people-affected figure is recorded simply as unknown. Beyond the group’s claim of internal-file exfiltration, further operational details remain undisclosed.

Inside trigona

Trigona is a ransomware operation that became publicly active in 2022 and has since been observed conducting double-extortion attacks: encrypting systems while simultaneously claiming to steal data for later publication or sale if a ransom is not paid. The group typically posts victim names and sample files on a dedicated leak site to apply pressure. Its targets have spanned multiple sectors and geographies, often reached through common initial-access vectors such as exposed remote-desktop services or phishing. Public reporting describes Trigona as a relatively opportunistic actor rather than one focused exclusively on a single industry. In the present case, the only statement attributed to the group is the listing of América Móvil and the assertion that internal files were exfiltrated; no additional claims specific to this victim appear in the record.

Who is America Movil?

América Móvil, S.A.B. de C.V., is one of the largest telecommunications conglomerates in the world, headquartered in Mexico. It was established in 2000 when the wireless operations of Teléfonos de México (Telmex) were spun off into a separate company. Today the group provides mobile, fixed-line, broadband and related services across Latin America and other markets, serving tens of millions of subscribers. As a major telecom operator it routinely processes customer account data, network configuration information, employee records and commercial contracts. A claimed compromise of internal systems at an organisation of this scale is consequential because of the volume and sensitivity of the information such companies typically manage and because of the critical role telecommunications infrastructure plays in everyday communications and commerce.

The information in question

The only data type named in the available facts is “internal files” said to have been exfiltrated. No further breakdown—such as customer databases, employee records, financial documents or network diagrams—has been disclosed. Organisations of América Móvil’s type commonly hold subscriber personal data, billing information, call-detail records, employee credentials and proprietary operational material. Because the exact contents of the claimed exfiltration remain unconfirmed, it is not possible to state with certainty which of these categories, if any, were involved.

What's at stake

For individuals whose data may have been among the internal files, the practical risks include potential identity fraud, targeted phishing, or unsolicited contact that exploits knowledge of account details. For the company itself, the stakes include operational disruption if systems were encrypted, regulatory scrutiny under data-protection regimes, reputational harm, and the cost of investigation and remediation. Because the scale of any exposure is unknown, the concrete impact on any given customer or employee cannot yet be quantified; the principal immediate concern is the uncertainty itself and the possibility that sensitive material could later appear on criminal forums.

Were you affected?

If you are a current or former customer, employee or partner of América Móvil, treat the listing as a prompt to review account activity and enable stronger authentication where available. Monitor financial and email accounts for unusual messages that reference the company or request personal information. Change passwords that may have been reused across services, and consider placing fraud alerts with credit bureaus if you reside in a jurisdiction that offers them. Readers can also run a free exposure scan of their email address to check whether that address has already appeared in other known breach data sets; such a scan does not confirm or rule out involvement in this specific incident, but it provides an additional data point for personal risk assessment. Official statements from the company, if and when they are issued, remain the most authoritative source of further guidance.

AICompiled with AI assistance from public sources and published under our editorial standards.