Author: MxTrib Staff

Photo: Unsplash

A year-long series of investigative reports by The Guardian and Quinto Elemento Lab, a Mexican investigative journalism unit, has forced the Mexican government to take wide-ranging action against industrial pollution in the Monterrey metropolitan area. The investigation centered on a factory called Zinc Nacional, located in the municipality of San Nicolás de los Garza, which imports and processes hazardous steel dust shipped from the United States. Federal regulators have now levied MX$83.2 million (approximately US$4.8 million) in fines and ordered the company to carry out 24 separate corrective measures.

The Guardian’s reporting, first published in January 2025, traced how American steel companies ship a byproduct known as electric arc furnace dust to the Zinc Nacional plant. This dust is left over from the process of recycling scrap metal, including old cars and appliances, in high-heat furnaces. It contains significant concentrations of lead, cadmium, and arsenic, and is classified as hazardous waste under both US and Mexican law. In 2022 alone, US companies sent nearly 200,000 tons of this material to the Monterrey-area facility, according to trade records reviewed by the reporting team. At the plant, the dust is processed in furnaces to extract zinc, which is then sold for use in fertilizer, animal feed, and paint.

A toxicology researcher from the Universidad Nacional Autónoma de México (UNAM), Martín Soto Jiménez, collaborated with the journalists and took soil and dust samples from 18 locations within a 1.5-mile (2.5 km) radius of the plant. The results were alarming. One elementary school, located half a mile from the facility, recorded lead levels on its window sills at 1,760 times the threshold that would trigger a public health response in the United States. Samples also revealed high concentrations of cadmium, arsenic, and zinc in homes, schools, and streets throughout the surrounding neighborhood.

Fines, Monitoring, and a Precedent-Setting Agreement

The Mexican government’s response has come in waves. According to the Guardian’s reporting, Profepa (the federal agency responsible for environmental inspection and enforcement) arrived at the plant in January 2025 and spent seven days conducting an investigation. Inspectors found improperly stored materials, including thousands of bags of hazardous dust sitting in the open air, some broken and leaking onto bare ground. The agency shut down 15 pieces of emissions-control equipment that lacked proper authorization.

In December 2025, Profepa issued the MX$83.2 million fine and confirmed the 24 corrective measures. It also signed what it called an Objective Environmental Responsibility Agreement with Zinc Nacional, requiring the company to repair, restore, and compensate for environmental damage. The agreement was established under Article 168 of Mexico’s General Law of Ecological Balance and Environmental Protection. Mariana Boy Tamborrell, head of Profepa, described the case as a turning point for the agency’s approach to industrial oversight.

As part of the corrective measures, Zinc Nacional is required to relocate its most polluting operations to a new plant outside the Monterrey metropolitan area. The company must also build new containment and water treatment infrastructure at its existing site, carry out soil remediation, and reforest 12 acres (5 hectares) of land. An additional four hectares have been set aside voluntarily for conservation and registration with Mexico’s National Commission of Natural Protected Areas (CONANP). Profepa says it will maintain permanent oversight going forward.

Perhaps most notably, the government announced plans for a new atmospheric monitoring network designed to track industrial emissions, including heavy metals. According to the Guardian’s reporting, officials described it as the first system of its kind in Latin America. Specifics remain limited. The Guardian noted that it was unclear at publication time whether the network would cover only the Monterrey area or apply more broadly across the country. Soto Jiménez, the UNAM toxicologist, said the monitoring system could prove meaningful if it includes real-time public access to data, allowing residents and independent scientists to review and analyze the information themselves.

A Factory Tied to America’s Hazardous Waste Pipeline

The investigation shed light on a much larger cross-border trade in toxic waste. According to the Guardian and Quinto Elemento Lab’s analysis of US records, American companies exported 1.4 million tons of hazardous waste to Mexico, Canada, and South Korea in 2022. The Monterrey region alone received nearly half of all hazardous waste the US sent abroad that year, including not only steel dust but hundreds of thousands of tons of spent lead batteries. Exports of toxic waste from the US have climbed 17% since 2018, the investigation found.

The Guardian’s broader reporting on Monterrey’s industrial emissions found that factories in the region release more toxic heavy metals into the air than the combined totals reported in many US states. The region’s carbon dioxide output from industry exceeds that of nearly half the world’s nations, according to the investigation. The metropolitan area of 5.3 million people has long struggled with poor air quality, and on bad days, Monterrey records some of the worst fine-particle pollution readings anywhere in the world.

Zinc Nacional, founded in 1952 and majority-owned by the Alverde Villarreal family, has pushed back against some of the findings. In a statement to the Guardian and Quinto Elemento Lab, the company acknowledged some contamination on its property but attributed it to a previous occupant of the site. It maintained that its own air emissions fall within regulatory limits and that no contamination is being carried into the air or nearby waterways. The company also disputed the methodology of the soil sampling conducted in the surrounding community, saying it did not prove the heavy metals originated from its operations.

Residents Demand Transparency and Accountability

For people living near the factory, the government’s announcements have been met with cautious frustration. Some residents told the Guardian that enforcement efforts focus too narrowly on contamination inside the plant’s boundaries while ignoring concerns about health effects and heavy metal levels in the surrounding neighborhood. Soil samples from homes and schools showed lead, cadmium, and arsenic concentrations well above safe thresholds, and residents want to know what will be done about contamination that has already spread beyond the factory fence.

Since the first stories were published in early 2025, neighbors have organized protests outside the plant and launched petition drives. The Guardian reported that demonstrators carried signs reading, among other slogans, “Take your mess to the US” and “Your millions are not worth our lives.” Community members have called on regulators to publicly share soil sample results and air emissions data going forward, and to impose enforceable deadlines on each step of the remediation plan.

Some residents expressed specific disappointment that the agreement did not address the health impacts already experienced by families living in the factory’s shadow. Susana de la Torre Zavala, the mother of two children attending a school adjacent to the plant, told the Guardian after a company-organized tour that parents were given little concrete information.

New Legislation and Citizen Action

The fallout from the investigation has extended to the legislative level. Federal senator Waldo Fernández, who chairs the Senate committee overseeing Mexico’s trade negotiations with the US under the USMCA framework, told the Guardian he is drafting legislation to amend Mexico’s environmental law. The proposed changes would restrict imports of certain categories of toxic waste that are deemed not “environmentally beneficial” for Mexico, including materials with high concentrations of arsenic, lead, and cadmium. The bill would also require plants that process heavy metals to monitor their emissions more rigorously.

Mexico’s primary environmental regulator, Semarnat, announced separately in December 2025 that it is updating three industrial air pollution standards, some of which had not been revised in decades. The proposed changes include cutting the allowable amount of particulate matter that factories can release into the air by 50%. Semarnat is also updating Mexico’s soil contamination standards, according to testimony its head gave before the national congress.

Two citizen groups in Monterrey have also taken action. One organization is collecting signatures for a referendum that would bring the city’s air quality standards in line with international guidelines. A second group, a prominent coalition of Monterrey-based activists known as the Group of 6, filed a lawsuit in December 2025 demanding a federal investigation into air emissions from industry across the region. Liliana Flores, one of the group’s founders, told the Guardian that thousands of people in Monterrey are estimated to die each year from air pollution, and that many others suffer from chronic illnesses including asthma. She noted that the largest industrial emitters are companies with the financial resources to adopt cleaner technology but have chosen not to do so.

What Comes Next?

Whether the government’s enforcement actions mark a genuine turning point or a temporary reaction to media pressure remains to be seen. Zinc Nacional has committed to moving its most intensive operations out of the Monterrey metro area within two years, but the company has not disclosed where the new facility will be located. The atmospheric monitoring network, if it materializes with real-time public data access, would represent a genuine first for the region. But details are scarce, and residents remain skeptical.

The investigation has made clear that Monterrey’s pollution problem extends far beyond a single factory. The Guardian and Quinto Elemento Lab’s analysis of emissions data from over 1,000 companies in the state of Nuevo León showed that Zinc Nacional reported emitting more arsenic than any other company in the state in 2023. But it is one of many industrial operations that collectively make the region’s air among the most polluted in North America. On an average day, Monterrey’s fine-particle pollution readings run nearly double those of Los Angeles, which has long been considered the most polluted major city in the United States.

For the families living in the shadow of the Zinc Nacional plant, the question is straightforward: when will someone clean up their neighborhood, test their children, and hold the responsible parties to firm, public deadlines? The answer, for now, depends on how seriously regulators follow through on what they’ve promised.

You can read The Guardian’s story in full here.

A hacker collective known as Chronus made good on threats Thursday, releasing massive amounts of personal data from government agencies and institutions across Mexico — including information from a private university in Yucatán.

The group dumped roughly 2.3 terabytes of data involving 25 institutions, according to cybersecurity journalist Ignacio Gómez Villaseñor, who reviewed the leaked files. Chronus estimates the breach affects about 36.5 million people, or 28% of Mexico’s population.

Among the affected institutions is Clínica Universitaria Anáhuac Mayab in Yucatán, alongside the municipality of Benito Juárez in Quintana Roo, which includes Cancún.

The data dump represents one of the largest cybersecurity breaches in Mexico’s recent history. It exposes personal details ranging from Social Security numbers and medical records to internal government documents and voter registration data.

Biggest target: IMSS Bienestar

The most extensive leak involved IMSS Bienestar, Mexico’s public healthcare system. Hackers released 1.8 terabytes in five compressed files containing the System of Social Protection in Health registry.

That database includes information on 3.15 million people, complete with direct validations from Mexico’s national population registry RENAPO, affiliation status, geographic locations and digital validation QR codes. The predominantly PDF format suggests hackers extracted complete digitized records, not just metadata.

Within an hour of publication, the IMSS Bienestar database had been downloaded 74 times.

The National Perinatology Institute also suffered a severe compromise. Hackers obtained a complete SQL database dump with more than 24 internal databases and 494,311 lines of records. The administrative-level access would allow reconstruction of the institute’s complete operational and clinical history.

Biometric data exposed

The National Insurance and Bonding Commission breach exposed information on 95,178 people in the insurance sector. Unlike other cases, this dataset includes biometric data such as personal photographs alongside CURP, RFC and license numbers — significantly increasing the risk of identity theft and high-quality fake documents.

The ruling Morena party’s affiliate registry was compromised, exposing data on 26,899 members. The leak includes voter credentials, affiliation status, personal phone numbers and internal review notes — information that could be used to identify and locate party members beyond public figures.

Mexico’s tax agency SAT also appears on the list, though the extent of that breach remains unclear. Chronus suggested more SAT information could be released through a VIP channel.

Complete list of affected institutions

The 25 compromised entities include:

• Clínica Universitaria Anáhuac Mayab
• Municipality of Benito Juárez, Quintana Roo
• Tax Administration Service (SAT)
• IMSS Bienestar
• Federal Health Secretariat (supplies)
• National Perinatology Institute
• National Insurance and Bonding Commission
• State health secretaries and prosecutors in Chihuahua, Tabasco and Tamaulipas
• Judicial Branch of Tabasco
• DIF systems in Zacatecas and Sonora
• State governments of Morelos and Nayarit
• COMUDE Guadalajara
• Autonomous University of the Northeast
• Morena political party
• National Institute of Political Training (Morena)

Hackers cite security failures

In a statement following the release, Chronus said the leaks demonstrate the “total inefficiency” of official security protocols and that government infrastructure “was always vulnerable.”

The breach came just weeks after Mexico unveiled its National Cybersecurity Plan 2025-2030 in early December. That 85-page document promised to make Mexico a “regional leader in cybersecurity governance” but lacked concrete budget allocations or implementation timelines.

Chronus has claimed responsibility for more than 1,700 security incidents since 2021, with 26 targeting Mexican public institutions. Previous victims include the states of San Luis Potosí and Coahuila.

Mexico’s Anti-Corruption Secretariat has opened investigations to determine how the breach occurred and whether administrative violations contributed to the security failures. Affected institutions must cooperate with inquiries and file criminal complaints where appropriate.

The primary risk to affected individuals is identity theft. Experts warn that exposed personal data could circulate for years, enabling criminals to open fraudulent accounts, file false tax returns or commit other forms of fraud.

No official statements have been released regarding victim notification protocols or data protection measures being implemented following the breach. Mexico remains highly vulnerable to cyberattacks, averaging four per second and registering more than 40 billion intrusion attempts in early 2025.

What to Know About the Mexico Data Breach

• The Chronus hacker group released 2.3 terabytes of data from 25 Mexican institutions on Jan. 30
• An estimated 36.5 million people may be affected, representing 28% of Mexico’s population
• Exposed data includes Social Security numbers, medical records, biometric information and voter credentials
• IMSS Bienestar suffered the largest breach with 1.8 TB affecting 3.15 million people
• A Yucatán university clinic and Cancún’s municipal government were among those compromised
• The breach occurred three weeks after Mexico unveiled its National Cybersecurity Plan
• Victims face elevated risk of identity theft, fraud and document forgery
• Investigations are underway but no victim notification protocols have been announced

Sources: Diario de Yucatán, Infobae, CETYS Universidad, Revista Morelia