Pemex DoppelPaymer ransomware (Mexico, 2019)

In November 2019, the Mexican state oil company Petróleos Mexicanos (Pemex) was hit by DoppelPaymer ransomware, which paralysed corporate IT systems for weeks. The attackers demanded 565 BTC (~$5 million). Pemex refused to pay; total recovery costs reached approximately $71 million.

What happened

The attack was detected on 10 November 2019. Pemex took computers offline across Mexico, halting payment processing and freezing key administrative communications. Internal emails initially mislabelled the malware as Ryuk; a public ransom note pointing to a darknet site clarified the family as DoppelPaymer, which was at the time a relatively new but already prolific ransomware operation.

DoppelPaymer's demand was 565 BTC (about $4.9 million at then-current prices), with a 48-hour deadline. On 13 November Pemex publicly stated it would not pay.

Oil production itself continued during the incident — Pemex's industrial operational-technology (OT) systems were architecturally separate and were not implicated. The blast radius was confined to corporate IT: email, payment processing, document management. Even so, the company reported cleanup costs of approximately $71 million, with only a small fraction covered by insurance.

Impact

• Corporate IT paralysed for weeks; payment processing froze.
• Operational-technology systems unaffected — oil production continued.
• No ransom paid (~$5M demand declined).
• Approximately $71 million in cleanup costs.
• Among the highest-profile no-pay decisions in critical-infrastructure ransomware history at the time.

Why it matters

Pemex is a foundational reference case for DoppelPaymer's shift from criminal-only operations toward high-value state-owned targets. It is also a strong early example of how IT/OT segmentation can keep ransomware out of safety-critical industrial control while still doing tens of millions of dollars of corporate damage.