By LCN Business Desk
Grupo Aeroméxico has traded on the New York Stock Exchange since November 2025, where its American Depositary Shares, each representing ten ordinary shares, were priced at US$19.00. The same ticker, AERO, carries the underlying shares on the Bolsa Mexicana de Valores in Mexico City. Since that listing the company has furnished sixteen reports to the United States Securities and Exchange Commission on Form 6-K. The word "cyber" appears in none of them.
On 20 September 2026 the airline published a statement in Mexico City acknowledging that a purported database of its customers was being offered to third parties. On 21 September it published a second, which went further: the data appeared to come from "an incident recorded in October 2025", in which "the unauthorised access occurred on a customer information management platform administered by an external provider."
The following day, 22 September, Aeroméxico furnished a report to the SEC. It was about its share price.
What did Aeroméxico tell the SEC?
The 22 September filing attaches a press release dated 18 September headed "Unusual Movements in the Trading Price of the Shares Representing the Company's Capital Stock," issued at the request of Mexico's National Banking and Securities Commission under Article 106 of the Mexican Securities Market Law. In it the company says it "is not aware of the causes that may have given rise to such movements, other than those that may be explained by publicly available information, including the publication relating to the holding of a General Shareholders' Meeting of the Company." That meeting notice had been published on 14 September, calling shareholders for 26 October.
The filing is signed by Ernesto Gómez Pombo, the airline's general counsel, and dated 21 September, the same day the company acknowledged the breach.
18 September is also the date the airline's own customer FAQ gives for when its cybersecurity team learned of the Telegram listing.
As at 11 October 2026, Aeroméxico has furnished no filing of any kind to the SEC since that 22 September report, and has not amended its annual report.
Was a Form 6-K required?
This is the question the gap turns on, and it has two parts.
The trigger is met on its face. General Instruction B to Form 6-K requires a foreign private issuer to furnish whatever information it "makes or is required to make public pursuant to the law of the jurisdiction of its domicile." The word "makes" matters: a voluntary press release in Mexico is caught, not only a mandated one. The airline made two. Among the enumerated categories, added when the SEC extended its cybersecurity disclosure rules to foreign issuers, is "material cybersecurity incident."
The second part is materiality, and the airline has a real case. Instruction B covers only information "which is material with respect to the issuer," and Aeroméxico's consistent position is that this incident was not. It says no financial data, payment cards or passwords were exposed; that its own infrastructure, operations and services were unaffected; that bookings, itineraries and loyalty points were untouched; that the access happened at a supplier, not inside its systems; and that when it occurred, no customer data was published by the attackers.
Three things pull the other way. The volume: the Telegram seller advertised more than 15 million records, and the Mexican authority obtained a sample of 100,092. The sensitivity: the airline's own FAQ lists passport number among the fields that may be involved, alongside full name, date of birth, nationality, gender, email, telephone and frequent flyer number. And the market: the company itself reported to its regulator that its share price moved unusually on 18 September, the day the listing surfaced. A price move is the conventional evidence that information matters to investors.
Whether that adds up to a material cybersecurity incident is for the SEC and the CNBV to determine, not a newspaper. What is verifiable from the public record is the standard, the two Mexican publications that start the clock, and the absence of any filing addressing them.
How long is "promptly"?
Shorter than most readers will assume, and undefined.
The four-business-day deadline widely associated with breach disclosure is a domestic rule. Form 8-K Item 1.05 requires a United States issuer to file "within four business days after the registrant determines that it has experienced a material cybersecurity incident." Aeroméxico is not subject to it. Its 6-K cover page checks the box for annual reports on Form 20-F, which marks it a foreign private issuer.
Form 6-K instead says the report "is required to be furnished promptly after the material contained in the report is made public." There is no number.
The triggers differ too. A domestic issuer's clock runs from its own materiality determination, a date only it knows. A foreign issuer's runs from publication at home, which is a matter of public record. For Aeroméxico that is 20 and 21 September 2026: twenty-one and twenty calendar days ago, fifteen and fourteen business days.
What have the airline's own filings said about cyber incidents?
Aeroméxico priced its New York listing on 7 November 2025, about three weeks after the October 2025 access its own statements now describe. The final prospectus told investors: "As of the date of this prospectus, we have not experienced significant system failures, but we cannot guarantee that system failures will not occur in the future." That sentence is about system failures alone. It does not say "cybersecurity incidents."
The annual report, filed 30 April 2026, adds the phrase, saying the company has "not experienced significant system failures or cybersecurity incidents impacting our business." Its dedicated cybersecurity item is more specific still: "We are not aware that we have experienced a material cybersecurity incident during 2025. In particular, no impact has been identified to proprietary, financial, sensitive or customer-related information, including reservations, itineraries, or flight data."
That is carefully drawn. Reservations, itineraries and flight data are precisely the categories the airline has since said were not exposed, and it is a statement about the calendar year in which it now says the access happened.
Both documents are specific about other companies' incidents, naming the 2022 cybersecurity incident at Boeing's Jeppesen subsidiary, the CrowdStrike outage of 19 July 2024 and a 2022 cyberattack on Mexico's civil aviation regulator. Their risk factors expressly contemplate "attacks through third-party platforms that we use," the vector the airline later described. The prospectus also discloses that the company "does not currently maintain cybersecurity insurance," and the annual report describes a security system certified to ISO/IEC 27001 and a requirement that suppliers "maintain security controls equivalent to" that standard.
Where does this leave Caribbean passengers?
In the data, and outside the list.
The airline flies about 535 scheduled passenger flights a day to 48 domestic and 51 international destinations, "including nine in Central America and the Caribbean." Cuban service resumed in October 2022 and accounted for 0.4 per cent of its passengers in both 2024 and 2025. It holds five trademarks in the Dominican Republic and employed seven people there at the end of 2025, and has announced Mexico City services to Montego Bay from 18 March 2027 and Nassau from 19 March 2027.
Both the prospectus and the annual report name the privacy regimes the company says bind it: "Mexico, the European Union, the United States, the United Kingdom, Peru and Colombia."
No Caribbean jurisdiction appears, including the two where the airline flies and employs staff. Jamaica has a Data Protection Act of 2020; the Dominican Republic has Ley 172-13; Cuba has Ley 149/2022. None is named.
For a Caribbean passenger whose passport number sat in that database, the regime under which they would complain is not one the airline has told its investors it answers to. Mexico's Anticorruption and Good Government Secretariat has opened an investigation on its own motion. No Caribbean regulator has announced one, in a region where cybersecurity capacity across critical infrastructure remains uneven.
What the title card shows
The card sets the headline against a table headed WHAT REACHED THE SEC, drawn from Grupo Aeroméxico's EDGAR record under CIK 1561861. The table gives five lines: 16 Form 6-K reports furnished since the November 2025 listing; 0 of those containing the word "cyber"; 0 filings of any kind since 22 September 2026; 6 privacy regimes named in its filings, listed as Mexico, the EU, the US, the UK, Peru and Colombia; and 0 of those that are Caribbean. A footnote records that under Form 6-K, General Instruction B, a material cybersecurity incident is furnished "promptly" after it is made public at home.
Beneath the headline a flag block reads GRUPO AEROMÉXICO, FORM 6-K, AND A DISCLOSURE THAT HAS NOT ARRIVED. Three figures run along the foot of the card: 16, for the Form 6-K reports since November 2025; 0, for how many mention "cyber"; and 20 DAYS, the interval between the airline's Mexican disclosure of 21 September 2026 and 11 October 2026.
Frequently Asked Questions
Did Aeroméxico report its data breach to the SEC?
No report addressing the incident has been furnished. The company has filed sixteen Form 6-K reports since its November 2025 New York listing, none containing the word "cyber," and nothing at all since 22 September 2026.
How many days does a foreign company have to report a cyber incident to the SEC?
There is no fixed number. Form 6-K requires the report "promptly" after the information is made public in the company's home jurisdiction. The four-business-day deadline belongs to Form 8-K Item 1.05, which applies to United States domestic issuers only.
What data was involved in the Aeroméxico incident?
The airline's customer FAQ lists full name, date of birth, nationality, gender, email, telephone, preferred route name, passport number and frequent flyer number. It says no bank accounts, payment cards or passwords were exposed.
When did the Aeroméxico incident happen?
The airline says the data appears to have been taken in October 2025, through unauthorised access to a customer information management platform run by an external provider. The data surfaced on Telegram on 18 September 2026.
Does Caribbean data protection law cover Aeroméxico?
The airline's own filings name Mexico, the European Union, the United States, the United Kingdom, Peru and Colombia as the privacy regimes applicable to it, and no Caribbean jurisdiction. Whether a Caribbean statute reaches it is untested, and no Caribbean regulator has announced an investigation.