Mexico to Launch Biometric CURP in 2026 Despite Concerns

Beginning in January 2026, Mexico will implement a biometric National Population Registry Code (CURP) as its mandatory national identification document. While this technological transition aims to modernize and strengthen citizen authentication, it has raised a significant alert among cybersecurity specialists who warn of the risks inherent in centralizing sensitive information.

The primary concern lies in the state's ability to protect a database of this magnitude and criticality.  “The government must implement security elements that allow data to be stored securely and reliably and that maintain the due confidentiality and integrity within the database,” says Ricardo Darling, Vice President of Cybersecurity, C3ntro Telecom, to Grupo Milenio. 

Mexico faces a complex cybersecurity landscape. The country has become the main target for cyberattacks in Latin America, recording 324 billion attempts in 2024, according to data from Fortinet.

Figures for 1Q25 show over 40 billion attempted attacks, which translates to a frequency of about 270,000 attacks per minute. This high-vulnerability environment aggravates the risks associated with creating a centralized repository of biometric data. This data includes fingerprints, iris scans, a photograph, and an electronic signature from the entire population.

Organizations such as Red en Defensa de los Derechos Digitales (R3D) and the Institute for Legal Research at the Universidad Nacional Autónoma de México (UNAM) argue that without a sufficiently strong legal framework and technological infrastructure, the system could be susceptible to security breaches with irreversible consequences, such as large-scale identity theft or improper surveillance.

The new Biometric CURP will be a mandatory requirement for transactions at government agencies and institutions in key sectors like banking, healthcare, and justice. Its stated objective is threefold: to reinforce the authenticity of citizen identity, to mitigate fraud, and to assist in locating missing persons through the creation of a Single Identity Platform. This platform will integrate various databases, such as the missing persons registry and the National Forensic Data Bank.

Although the design of the Biometric CURP is intended to be inherently secure, a successful attack would have a massive impact. Faced with this scenario, technical experts have outlined a series of essential security measures that the government should implement. 

Darling recommends a multi-layered approach that begins with end-to-end encryption to protect data both in transit and at rest. This should be complemented by database segmentation, which limits the scope of a potential security breach and prevents a single point of failure from compromising the entire system. To secure access, multi-factor authentication (MFA) is critical to ensure information access is verified through multiple credentials. Furthermore, the framework requires real-time monitoring for the immediate detection and response to anomalous activities. Finally, continuous personnel training will be essential to mitigate the risk of human error, which remains one of the main attack vectors.