Telcel and the registry that exposed data as if it were a public drive
Well, it turns out that the Mobile Registration that began in January – that procedure where you have to match your number with your identity as if it were bureaucratic Tinder – had a small detail. Or rather, a hole the size of the Azteca Stadium. It turns out that while you were worrying about taking the most presentable selfie for “proof of life”, Telcel was leaving your personal data visible to anyone with a browser and some unhealthy curiosity.
When your CURP becomes a trending topic
Things got good when content creators like @brujeriatech (a very appropriate name for this digital spell) exposed the glorious glitch. Imagine this: on the official registration page, just by entering a phone number, the system released all the personal information as if it were a hacked piñata. CURP, RFC, date of birth, email – the complete identity package, ready to be picked up by anyone passing by. You didn’t need a password, or OTP code, or even guess the name of your first pet. It was the digital equivalent of leaving your wallet open on the subway at 6 p.m.
“Your data is safe. Each user receives a unique code by SMS to access only their own information”
That’s what Telcel said on social media after the scandal went viral faster than a cat reel. His statement sounded as convincing as when someone tells you “trust me” while making elusive eye contact. They implemented “additional security measures”, of course, after half of the internet already knew about the problem.
The CTR and the security that comes after the scare
The Telecommunications Regulatory Commission (CTR), for its part, admitted that there were “intermittencies” – a nice word for “catastrophic failures” – but did not specifically confirm or deny the data leak. Let us remember that according to their own rules, providers must protect data against unauthorized access. Something that obviously failed more than my attempt at making bread during the pandemic.
The irony is all the biometric theater they ask of us: specific selfies, official documents down to the millimeter… only to then have the security of the system depend on how robust its backend code is (spoiler: it wasn’t).
If after this circus you still have trouble registering your line online (sorry for the redundancy), Telcel offers the in-person option. Yes, the one where you stand in line for hours with your INE in hand, feeling like you’re in 2019 but without the pre-TikTok innocence. Bring all your original documents – because now more than ever we know how valuable that information is.
The moral? In the Mexican digital age, your personal data is like that friend who promises to arrive on time: you never know where it will end up appearing.
—
Did this thing give you digital anxiety? Share this story to keep everyone alert about where we leave our personal information.
