Claude Code & ChatGPT Used to Steal Millions of Records in Mexican Government Breach

An AI-accelerated cyber campaign from late 2025 to early 2026 compromised at least nine Mexican government organizations, exfiltrating hundreds of millions of records (e.g., 195M taxpayer records from SAT and ~220M civil records from CDMX). The attacker used Claude Code to refine and execute exploits and ChatGPT (GPT-4.1 API) to automate internal reconnaissance across 305 SAT servers, producing thousands of structured intelligence reports, enabling fast privilege escalation, lateral movement, a live taxpayer data API, and a system for forging official tax certificates; the report emphasizes that AI amplified speed and scale but that foundational controls (patching, credential hygiene, segmentation, behavioral detection) remain the primary defenses.