Luis Lima, general director of supervision and information security of the CNBV, told Expansion that it is necessary to standardize regulations for all players in the financial system.
“We need to standardize the regulations so that all institutions are obliged to do so, and we need to adjust the regulations to make them more precise: separating them by severity – because not all of them are serious – and trying to raise awareness among trade union groups,” he said.
The official added that banks, Sofipos, Sofomes, Socaps, Brokerage Firms and intermediaries have different regulations regarding cybersecurity, which causes the reports to be uneven.
“There are different regulations for each sector, so each one of them would have to be changed. It is a long process but eventually the right path will follow: regulating not only the report, but regulating cybersecurity in a way that cuts across all sectors,” he added.
So far in 2024, the CNBV has registered 15 attacks on financial institutions of which 5 have been against systems, 3 have been information leaks, 2 against ATMs and 2 through the theft of credentials.
There are also two other cases in which third parties working with financial institutions have been compromised, in addition to data being exposed on the internet.
However, the Bank of Mexico (Banxico) only has two cyber incidents in its records: one against a bank and another against a Sofipo. As of September of this year, the damage caused by these attacks amounts to 140.49 million pesos, 57.7% more than the damage caused by the attacks that occurred in all of 2023.
The economic impact of cyber attacks in 2022 amounted to 25.25 million pesos and in 2021 the figure was 570.8 million pesos.
Lima said that banks currently have “acceptable” regulations, but he believes that they can be adjusted.
