Mexico's Anti-Corruption and Good Government Ministry is investigating a Telegram post that offered an alleged Aeromexico database of more than 15 million records (1.10 GB). Authorities obtained a sample of 100,092 records containing names, contact details and birth dates but say the dataset's origin is unconfirmed. Aeromexico says no financial data or passwords have been found and its operations continue normally while investigators check whether the files stem from a new intrusion or a prior October 2025 breach.
Mexico Opens Probe After Telegram Post Offers Alleged Aeromexico Database of 15M+ Records
Mexico's Anti-Corruption and Good Government Ministry said Sunday it found indications of a possible exposure of personal data after identifying a Telegram post in which a user offered a database attributed to the airline containing more than 15 million Aeromexico records. File Photo by Mario Guzman/EPA
The Mexican government has launched an investigation after a Telegram post offered a database allegedly tied to Aeromexico that reportedly contains more than 15 million customer records (about 1.10 GB).
Mexico's Anti-Corruption and Good Government Ministry said it identified the Telegram listing and obtained a sample of 100,092 records that match the fields described in the post. The sample reportedly includes full names, email addresses, phone and mobile numbers, dates of birth and passenger registration dates. The ministry noted the sample appears to contain names of public officials and public figures, though none were identified publicly.
Ministry Cautions Origin Remains Unconfirmed
Authorities caution that the source of the dataset has not been established and are describing the information as "allegedly attributable" to Aeromexico while they verify its provenance. Investigators will analyze the data and related evidence to determine whether the records originated from Aeromexico's own systems or from an external provider.
Aeromexico Response
In a statement, Aeromexico said it has opened a comprehensive investigation to verify the origin and authenticity of the materials. The airline reported it has found no evidence so far that financial information, payment card numbers or customer account passwords were exposed. Aeromexico added that its operations continue to run normally.
Context: Prior Cyberattack And Possible Threat Actors
Authorities opened the probe under Mexico's Federal Law on Protection of Personal Data Held by Private Parties to determine whether any violations occurred and to impose sanctions if warranted. The inquiry follows a major cyberattack that affected Aeromexico in October 2025 and compromised a database of more than 20 million records. Investigators and outside experts are examining whether the records now appearing on Telegram represent a fresh intrusion or information taken during the earlier breach.
Cybersecurity specialists have also warned about the ShinyHunters group, which has previously claimed to possess tens of millions of Aeromexico customer records and threatened to publish them on the dark web. Based on currently available information, Aeromexico has not officially confirmed the Telegram claims or definitively linked the posted dataset to the incident reported by authorities.
What Customers Should Do: Customers potentially affected should monitor account and payment activity, enable any available account security options, and watch for official notices from Aeromexico or regulators. Authorities will provide updates as the investigation progresses.
Help us improve.
