Account Takeover Quadrupled at Mexican Banks

Banks in Mexico recorded a quadrupling of account-takeover attacks during 2025.

The corpus records credential supply constantly: 16 billion credentials in unsecured datasets at 25-0620, India accounting for 49% of compromised accounts in Asia at 25-0912, 133 telecom database listings at 25-0716.

Account takeover is what that supply is for. It is the closest thing in this database to a measured downstream consequence of credential exposure — which makes it more interesting than the supply figures, because the missing link at 25-1219 is exactly this.

A fourfold rise in takeovers alongside rising credential availability is correlation. Nothing here traces a specific takeover to a specific breach, and takeover volume also responds to phishing, malware, SIM swapping and stolen devices — the categories at 25-0317.

The corpus should resist the temptation to treat this as the proof it has been looking for. It is consistent with the hypothesis and does not establish it.

A bank has every incentive to measure account takeover precisely: it usually bears the loss, it must report to a supervisor, and it needs the data to tune its own controls.

That makes banking one of the few sectors where the downstream consequence is measured at all — the same reason financial-sector incident counts at 25-0616 are closer to a census than most. The measurement exists where somebody pays.