Mexico - October 2026

A recent data breach at Mexico’s flag carrier, Aeroméxico, exposed information that includes names, dates of birth, email addresses, and phone numbers. However, the airline has assured that no financial data has been leaked, such as bank account numbers or credit card details, nor passwords or information related to flight itineraries.

Although it was not clear that any data had been leaked at the time, Aéromexico said that the breach may have happened in October 2025 “as part of an international campaign of cyberattacks that affected companies from diverse sectors” – in this case a customer information management platform administered by an external provider. 

Aeroméxico’s communiqué followed an earlier 20 September statement from the ministry of anticorruption and good governance, saying that it might have identified a breach of personal data in a system linked to Mexico’s principal international airline, which operates flights to more than 120 destinations. 

As a part of the ministry’s routine monitoring, it said that it had discovered a post on messaging platform Telegram, published on 18 September, in which a user offered access to a database “allegedly belonging to Aeroméxico containing more than 15m records … which reportedly included full names, email addresses, landline numbers, cell phone numbers, dates of birth, and registration dates”. The ministry said it had obtained a sample of around 100,000 of these records which it would analyse in order to begin an investigation to determine the party responsible for the compromised database.

“We immediately launched an investigation to verify the authenticity of the information, determine its origin and establish the scope of any possible impact,” the airline said in a statement. As a preventive measure and in line with digital security best practices, Aeroméxico advised customers to remain vigilant regarding emails, messages, or calls requesting personal information. “At Aeroméxico, we are continuously monitoring the situation; we will collaborate with the competent authorities and pursue appropriate legal action against those found responsible for any illicit conduct,” the company stated.

Aeroméxico did not say that its own systems or databases had been targeted in the incident, but it is believed to be connected to a major cyberattack in October 2025 by cybercriminal group ShinyHunters, which affected Aeroméxico and 38 other major companies.

At the time, ShinyHunters threatened to disclose sensitive data on the dark web unless their ransom demands were met. Other victims of the attack are believed to have included Japanese carmaker Toyota, US courier service FedEx, multinational entertainment conglomerate Disney, multinational hotel group Marriott, US pharmacy store chain Walgreens, US home improvement retail corporation Home Depot, international carmaker Stellantis, and US fast food chains McDonald’s and KFC, as well as Australia’s flag carrier Qantas Airways and French-Dutch multinational airline Air France–KLM.

Investigations are currently attempting to determine the precise connection between Aeroméxico and this latest episode. Hackers have previously targeted federal and state governments in Mexico, including the defence ministry and state oil company Pemex.