A Mexican electronic document management provider, EDX Solutions, left hundreds of gigabytes of customer data reachable on the open internet, with the bulk of the exposed material tied to PepsiCo operations across Latin America. The finding comes from Cybernews researchers, who estimate at least 30 million sensitive records were involved and say the trove included employee accounts, plaintext credentials, and tax data. As of publication this is a single-team disclosure: Cybernews reports it contacted EDX Solutions and received one initial reply before the company went silent, and says it also notified Mexico's CERT. Neither EDX Solutions nor PepsiCo has issued a public statement, and no regulator filing or vendor advisory confirming the incident exists in the source set. Treat the figures below as researcher estimates, not victim-confirmed numbers.
What Happened
EDX Solutions is a small Mexico City headquartered firm that handles digital document exchange, electronic billing, accounting, and tax administration for B2B and B2C clients. Public company profiling puts it at roughly 30 to 40 employees with annual revenue under $1M, founded in 2005, with staff distributed across six countries including Mexico, Peru, Spain, Guatemala, and Argentina. That is the profile of a classic supply chain weak link: a vendor far smaller than the customers whose data it processes.
According to Cybernews, researchers discovered exposed data stores totaling hundreds of gigabytes. Roughly three quarters of the exposed volume, 218GB, sat in a single database that the research team attributes to PepsiCo's Colombian branch. Other PepsiCo locations across Latin America were also represented, with Colombia described as the most heavily affected country.
The vendor relationship is independently corroborated, if only circumstantially. A LinkedIn profile for an IT support consultant who worked at EDX Solutions in Mexico City from March 2022 to February 2024 describes the job as generating RPT invoice templates in Visual Studio and producing XML documents and fiscal invoices for PepsiCo and Gondi, reviewed against SAT (Mexican tax authority) requirements. That is low-tier sourcing and proves nothing about the exposure itself, but it does independently place PepsiCo invoice and tax document processing inside EDX Solutions.
One point of caution on the source pool worth stating plainly. Two of the technically detailed documents circulating alongside this story, the advisories for CVE-2026-53636 (an LTI OAuth nonce replay flaw in the Open edX Platform) and CVE-2024-22209 (a JWT scope authentication bypass in edx-platform), concern Open edX, the open source online learning platform. That is an entirely different organisation from EDX Solutions, the Mexican billing provider. The name collision is coincidental. Nothing in the reporting connects either CVE to this leak, and defenders should not chase those patches in response to this incident.
What Was Taken
"Taken" is the wrong verb here, and the distinction matters. This is an exposure, not a confirmed exfiltration. The reporting describes data accessible to anyone who found it, not evidence that a threat actor pulled it down. There is no known ransom demand, no leak site listing, and no named actor.
What was exposed, per Cybernews:
- Scale: at least 30 million records, by the researchers' own estimate. This is the only figure any source provides. No second count exists to corroborate or contradict it, so it should be read as one team's estimate rather than an established number.
- Volume: hundreds of gigabytes total, of which 218GB sat in one database attributed to PepsiCo Colombia.
- Invoice data: a collection in a database identified as
Colombia-apiheld over 11 million records covering invoice transactions, including full invoice documents, their identifiers, and timestamps. - Credentials: at least one record containing plaintext credentials for an internal API, alongside several configuration records.
- Employee accounts and tax data: named among the exposed categories across the broader trove.
Fiscal invoice data in the Mexican and Colombian context is not low sensitivity. CFDI-style electronic invoices carry taxpayer identifiers, registered addresses, line item detail, and counterparty information. Aggregated across 11 million transactions, that is a functional map of a beverage and snack distributor's supplier network, pricing, and regional operations.
Why It Matters
The strategic lesson is the one the researchers themselves flagged: the security posture of a Fortune 50 enterprise is bounded by the posture of its smallest processor. PepsiCo maintains a substantial internal incident response capability. Public job listings and professional profiles show a Cyber Fusion Center with dedicated incident response handlers in Australia, cybersecurity incident response analysts, and a Global Cybersecurity Incident Commander role based in Plano, Texas, with compensation for the incident management commander position listed at $110.7k to $185.3k. The role descriptions explicitly call out managing incidents involving third-party compromise and data exfiltration. None of that internal muscle prevents a 30 person billing vendor in another hemisphere from misconfiguring a database.
Three practical implications for defenders:
Regional vendors are the soft underbelly of global programs. Latin American operations frequently depend on local fiscal compliance vendors because e-invoicing is legally mandated and country specific. Those vendors are rarely subject to the same assurance rigor as the global SaaS estate, and they often hold the most regulated data.
Plaintext credentials in a data store are a pivot, not just a leak. A single working API credential converts a passive exposure into a potential active intrusion path back toward the client environment. The exposure of configuration records alongside it compounds the risk.
Silence is an operational signal. A vendor that answers once and then stops responding to a disclosure is unlikely to be running a competent containment process. Downstream customers should not assume remediation has happened just because the story has run.
The Attack Technique
There is no attack technique to describe, and any brief claiming otherwise is inventing detail. The available reporting describes data discovered by researchers in an accessible state. It does not describe intrusion, exploitation of a named vulnerability, credential theft, phishing, or ransomware. No CVE has been linked to the incident by any source. No threat actor has been named or has claimed the data.
The most defensible characterisation is misconfiguration or inadequate access control on internet reachable databases operated by the vendor, consistent with the pattern of exposed document stores and API backed collections described in the reporting. The mention of a Colombia-api database and accompanying configuration records suggests application backend data stores rather than a file share or backup archive, but the sourcing does not confirm the specific technology or the specific misconfiguration.
Again, for clarity: the Open edX CVEs circulating alongside this story, the LTI nonce replay issue patched in commit 3a5ac85 and the JWT scope bypass patched in commit 019888f, describe real vulnerabilities in a real product, but that product is an e-learning platform and not this victim. Do not build a timeline that fuses them.
What Organizations Should Do
- Inventory your regional fiscal and e-invoicing vendors specifically. Pull the list of third parties that process tax documents, CFDI or equivalent invoices, and payroll data in Latin America and other mandated e-invoicing jurisdictions. These frequently sit outside the central vendor risk register because they were procured locally.
- Rotate any credentials shared with document and billing processors now. Assume API keys, service accounts, and integration credentials issued to a processor of this kind are compromised until proven otherwise. The reporting explicitly describes at least one plaintext internal API credential in the exposed data.
- Audit inbound integration paths from vendor networks. If a billing vendor holds credentials into your environment, review authentication logs for those service accounts over the maximum retention window available, and scope the accounts down to the minimum needed.
- Contractually require breach notification with a hard clock, and test it. A vendor that replies once and goes quiet is a contract failure as much as a security one. Notification SLAs, evidence preservation obligations, and a named security contact should be table stakes for anyone holding regulated tax data.
- Scan your own external attack surface for the same failure mode. Unauthenticated, internet reachable document and API databases are the recurring root cause in this class of incident. Continuous external discovery catches them before researchers do.
- Prepare regional regulatory response in advance. Exposure of Colombian and Mexican taxpayer and employee data brings local data protection obligations into play. Have the notification path mapped before you need it, not during the incident.
For organisations that actually run Open edX, patch CVE-2026-53636 and CVE-2024-22209 on their own merits. They are unrelated to this incident, and confusing the two wastes response capacity.
Sources: 30 million records exposed in EDX leak tied to PepsiCo | CVE-2026-53636: Open edX Platform CSRF Vulnerability | CVE-2024-22209: Edx-platform Auth Bypass Vulnerability | Pedro Indalecio Perez Muñiz | Cybersecurity Incident Management Commander @ PepsiCo Simplify Jobs | David Lawrence | Incident Response Handler HubMub | Cybersecurity incident response analyst - PepsiCo (Council Of The C...