EDX Solutions Leak Exposes 30 Million Records Tied to PepsiCo Latin America Operations

What was exposed

Cybersecurity researchers discovered a publicly accessible MongoDB database owned by EDX Solutions, a Mexican electronic document management provider, on July 2, 2026. The instance contained 48 databases with 292GB of data belonging to EDX and its clients, and researchers estimate at least 30 million sensitive records were exposed.

The leaked data included invoices, tax documents, employee accounts, plaintext credentials, API tokens, and supplier details. Companies in at least eight countries were impacted, with PepsiCo's Latin America operations bearing the brunt of the exposure.

Which countries were hit hardest

Colombia was the most affected nation, with over 221GB of data exposed. A single database held 218GB, three quarters of the total leak, and belonged to PepsiCo's branch in Colombia. One collection in the Colombia-api database contained over 11 million records, including full invoice transactions, identifiers, timestamps, and at least one record with plaintext credentials to an internal API.

Peru appears second most exposed with over 42GB, mostly tied to PepsiCo Peru and the local division of Swiss building materials company Holcim. The Dominican Republic had nearly 18GB exposed, linked to PepsiCo's local operations and a company in the wholesale distribution sector. El Salvador saw 7GB exposed, Costa Rica 2GB tied mainly to CSU supermarkets, and Ecuador 41MB, the least affected.

Why the leak is dangerous

Researchers warn the data could enable financial fraud, employee account takeovers, and social engineering. Because the records include invoice files, tax documents, digital certificates, API credentials, and supplier contact data, attackers could impersonate trusted businesses, tamper with invoicing workflows, or submit fraudulent documents that appear legitimate.

The leak also creates a direct path to fake payment requests, supplier payment diversion, and invoice manipulation. Leaked tax IDs, validation results, and internal workflow records could help criminals study billing and compliance processes, making scams harder to detect. Employee account data, recovery codes, and internal endpoints could support account takeovers and long term supply chain impersonation across multiple countries.

EDX responds

Researchers first disclosed the leak to EDX on July 7, 2026 and contacted Mexico's CERT on August 8, 2026. After the article was published, EDX stated it had secured the instance, which researchers confirmed was no longer publicly accessible. The company said it revoked all credentials, API tokens, and secrets present in the instance, and engaged an independent forensic firm to determine the full scope of the exposure and whether any unauthorized party accessed the data.

EDX said it invests continuously in updating and strengthening its security systems and is implementing additional controls as a result of the incident. The leak was observed closed on September 28, 2026.

Sources: Cybernews