Aeroméxico Admits Hack Exposed Passenger Passport Data

Mexico City — Aeroméxico has released the findings of its investigation into a September data breach, confirming that passenger passport numbers, frequent flyer numbers, full names and dates of birth were exposed.

In a notice sent to customers, the airline said other information — including nationality, gender, email address, telephone number and preferred route — may also have been involved, but classified those fields as “potentially affected.”

Aeroméxico said its cybersecurity team first learned of the incident on September 18, 2026, while monitoring online activity. The team spotted a post on Telegram in which a third party unaffiliated with the airline was illegally offering for sale what was described as a customer database belonging to the company. The case was later reported by Mexico’s Anti-Corruption and Good Government Ministry (SABG).

“We immediately launched an investigation to verify the authenticity of the information, determine its origin and establish the scope of any possible impact,” the airline said. That review found the data was tied to a separate security incident in 2025 involving an information management platform run by one of Aeroméxico’s outside providers, set against the backdrop of an international wave of cyberattacks targeting companies across multiple industries.

The airline stressed that financial information was not compromised and “remains protected,” adding that bank accounts, payment cards and loyalty program passwords showed no signs of exposure.

The SABG had previously flagged indications of a possible leak of personal data in a system that might be linked to Aeroméxico after the Telegram post surfaced on September 18, 2026. At the time, the ministry said the database appeared to contain more than 15 million records totaling 1.10 gigabytes, including full names, email addresses, landline and mobile phone numbers, dates of birth and registration dates. Officials said they obtained a sample of 100,092 records with those same fields and identified names of various individuals, among them public servants and public figures.