Xcaret Reports Data Breach Affecting 8,300 Customers’ Contact Information

Playa del Carmen, Quintana Roo — Grupo Xcaret said a security incident allowed the extraction of contact data, including email addresses and mobile phone numbers, belonging to roughly 8,300 customers of its parks, and warned that the stolen information could be used in fraudulent payment attempts.

The company said financial information, including bank account numbers and payment card details, was not compromised.

In a statement, Grupo Xcaret said it detected the incident in recent days and linked it to unauthorized communication mechanisms inside the sales systems used exclusively by its parks. The affected records date to Oct. 21.

The company said the exposed records represent less than 0.003% of the total contacts registered this year. It added that it found no evidence that financial data was exposed.

What the company is warning about

Xcaret said the stolen contact details could be used to send emails and text messages that try to collect payment for reservations in the company’s name.

It advised customers to distrust any message that requests money through a link sent by phone or from an email address other than its official ones.

The company stressed that it never sends payment links by text message and that official communications from its park sales channels come only from its corporate email accounts. The warning is aimed at preventing customers whose data was exposed from falling victim to reservation-related fraud.

What customers should do

Grupo Xcaret said it has contacted the affected customers individually to inform them about the incident and the preventive measures they should take.

It asked customers to ignore payment requests that arrive by phone call, text message or email from addresses other than the official ones, and to verify any suspicious communication before making a transaction.