A cybersecurity company based in Mexico, BePrime, was reportedly the victim of a cyberattack that allegedly resulted in the leak of 12.6 GB of data and access to network infrastructure and video surveillance, according to information published by the supposed attacker on a cybercrime forum. The company, which provides connectivity and security services to large corporations such as Iberdrola, ArcelorMittal, Whirlpool, or Alsea (operator of Starbucks, Domino's, and Vips), was allegedly compromised by accessing administrator accounts without multifactor authentication (MFA), according to the malicious actor's claims. That is, although it seems paradoxical, the company apparently did not have one of the most basic and recommended security measures for critical environments. The attacker claims to have used credentials and API keys associated with Cisco Meraki environments to take control of 1,858 network devices, including switches and routers, which would have given them access to the traffic of more than 2,600 connected devices, as reported by journalist Ignacio Gómez Villaseñor on his X profile. Among the allegedly extracted data would be plaintext credentials, transaction information, and—more seriously—security audit reports (pentests). These would detail point by point current vulnerabilities of each client. "The irony that a firm selling cybersecurity was breached for not having two-factor authentication (2FA) on its administrator accounts results in a total loss of trust," notes hacker Alberto Daniel Hill on X. "The dissemination of unalterable visual evidence, such as screenshots of Cisco Meraki panels and live surveillance cameras, creates a 'forced transparency' in front of public opinion that prevents the company from covering up or minimizing the attack," he adds. For this cybersecurity professional, the incident is of great severity, as "unauthorized access to the control systems of energy sector suppliers represents a direct threat to Mexico's energy sovereignty and national security." BePrime admits the security breach In a