Personal information of hundreds of Mexican journalists exposed in government data leak

Mexican authorities must promptly investigate the government leak that exposed the information and take all necessary steps to prevent such leaks from occurring again, CPJ said Thursday.

According to the reports and images later published by several Mexican and foreign media, the information leaked contained journalists’ full names, their CURP code (a personal identity code similar to a social security number), and a copy of a personal identification document. The last items are of particular concern, as many Mexican reporters use electoral cards as their ID, which include their addresses.

The leak was first reported on Friday, January 26, by several journalists, including Daniel Flores, who posted about it on X, formerly known as Twitter. It is unclear how long the information was publicly available on the website before it was taken down on January 26.

In a January 29 press conference, President Obrador said that his administration is investigating the leak, and several government officials said the information had been extracted from an “inactive government website” by someone using the username and password of a former government employee via an IP address registered in Spain.

The information was extracted on January 22, but the leak was not detected until January 26, the officials said, adding that the personal information of 309—rather than the initially reported 324—reporters had been compromised but denied that the government itself was responsible for the leak and affirmed that the government systems containing personal information are “safe.”

Journalists who attend the president’s daily press briefing—popularly known as la mañanera—and have asked the president critical questions have been subjected to harassment and threats in the past, as CPJ has reported.

“In what continues to be the most dangerous country for journalists in the Western Hemisphere, it is shocking that the personal information of hundreds of reporters can be so easily extracted from government systems and made publicly available, especially considering the many threats and harassment reporters covering the president have been subjected to,” said Jan-Albert Hootsen, CPJ’s Mexico representative. “Mexican authorities must immediately identify the perpetrator, bring them to justice, undertake a thorough review of the security of its systems containing sensitive personal information, and ensure that no such leak can occur again in the future.”

Daniel Flores, a reporter with news website Reporte Índigo and one of the journalists whose personal information was leaked, told CPJ that he was advised on January 26 by a former editor that his personal information, including a copy of his electoral card, were available on a website.

“I and some other reporters were able to download the information from that website, so we have to assume that other people were able to do so as well,” Flores told CPJ. “My biggest concern is that it could be used for identity theft.”

In the wake of the leak, the National Institute for Access to Information and Protection of Personal Data (INAI), a federal agency, said in a January 28 statement that it was investigating the data breach.

According to the statement, Mexican privacy laws compel any government agency subjected to a data breach to immediately inform the people whose information has been leaked.

Flores told CPJ that the federal government had not informed the reporters whose information was leaked until it was already widely publicized in national and international media. Rodolfo Montes, a freelance investigative reporter whose data was leaked, also told CPJ that he only received a notification from the office of the president that his data was leaked after the leak had been widely publicized.

Several calls by CPJ to the president’s spokesperson Jesús Ramírez Cuevas between January 26-30 for comment were not answered. CPJ’s email to the INAI did not immediately receive a reply.

Mexico is the deadliest country in the Western Hemisphere for journalists. According to CPJ research, at least two journalists were killed in 2023. CPJ is investigating those killings to determine the motive.