By LCN Business Desk
The regulator did not learn of the Aeroméxico data from Aeroméxico.
In a statement dated 20 September 2026, Mexico's Secretaría Anticorrupción y Buen Gobierno said active forensic monitoring had identified indications of a possible exposure of personal data in a system that "podría estar relacionado con Aeroméxico", could be related to Aeroméxico. What the monitoring found was a posting shared on Telegram two days earlier.
What does the ministry say it found?
A listing, a size, and a sample it pulled itself.
The posting of 18 September offered a database "supuestamente atribuible a Aeroméxico", supposedly attributable to the airline, running to more than 15 million records and 1.10 GB. The fields advertised were full name, email address, telephone, mobile, date of birth and date of registration.
The ministry obtained a sample of 100,092 records carrying those same fields. Among the names in it, the statement says, were "personas servidoras públicas y figuras públicas", public servants and public figures. It said it would analyse the material in order to open an investigation of its own motion, "de oficio", to establish presumed responsibility.
| What the ministry stated on 20 September 2026 | |
|---|---|
| How it was found | Active forensic monitoring, not a report from the company |
| Date of the Telegram posting | 18 September 2026 |
| Volume advertised | More than 15 million records, 1.10 GB |
| Fields advertised | Full name, email, telephone, mobile, date of birth, date of registration |
| Sample the ministry obtained | 100,092 records |
| Who was in the sample | Names including public servants and public figures |
| Attribution to the airline | Hedged throughout: "could be related", "supposedly attributable" |
Source: Secretaría Anticorrupción y Buen Gobierno, "Buen Gobierno identificó indicios de una posible exposición de datos personales", 20 September 2026. Translations from the Spanish are ours, with the original quoted alongside.
Nothing in the statement concludes that the data is Aeroméxico's, that the airline's systems were breached, or that any obligation was broken.
Who is the authority running this?
A government ministry, because the independent one was abolished.
Until last year Mexico's data protection regulator was the Instituto Nacional de Transparencia, Acceso a la Información y Protección de Datos Personales, INAI, an autonomous body. A decree published in the Diario Oficial de la Federación on 21 March 2025 extinguished it and moved its functions into the Secretaría Anticorrupción y Buen Gobierno, a department of the federal executive headed by Raquel Buenrostro Sánchez, with a deconcentrated agency named Transparencia para el Pueblo carrying the transparency work.
So the body that found the listing, pulled the sample and will decide whether to pursue the airline sits inside the government rather than beside it. For a foreign investor reading disclosure risk in a Mexican issuer, that is a different institutional picture from the one that existed in 2024, and it is the picture that now applies.
Has the airline told the SEC?
No. Checked again on 15 October 2026.
Grupo Aeroméxico's most recent filing of any kind on EDGAR, under CIK 1561861, remains the Form 6-K furnished on 22 September 2026. That report was about its share price. Nothing has been furnished since, and the annual report has not been amended.
Twenty-four days have passed since the airline's own Mexican disclosure of 21 September. The standard, the sixteen Form 6-K reports furnished since the November 2025 New York listing, and the absence of the word "cyber" from all of them were set out in Aeroméxico Disclosed Its Data Breach in Mexico. It Has Not Reported It to the SEC.
Whether the incident is material is for the SEC and Mexico's banking and securities regulator to determine. What has changed since that piece is that a federal authority has said publicly it intends to investigate.
What has Aeroméxico said?
That it is checking the data, and that it has not identified financial exposure.
The airline says it is investigating the authenticity of the information, its origin and the extent of any harm. It says it has not identified any exposure of financial information, payment cards or passwords, including for users of Aeroméxico Rewards, and that its operations have not been affected. It has acknowledged an event in 2025 involving a platform administered by an outside supplier.
Those statements and the ministry's are not in conflict. One concerns what the airline has so far found in its own systems. The other concerns what a monitoring team found being offered on a messaging platform.
Why does this matter beyond Mexico?
Because the carrier flies into the Caribbean and the questions are the same ones the region keeps meeting.
Aeroméxico's Caribbean network and the visa arrangements around it were examined in Aeroméxico Will Fly to Jamaica and The Bahamas. A passenger who booked in Kingston or Nassau sits in the same database as a passenger who booked in Mexico City, and no Caribbean data protection authority is named anywhere in this matter.
The ministry's statement is also not the only one of its kind. On 24 September it published a separate notice on an investigation into the presumed sale of more than 12.9 million records of personal data, a different matter with a different holder.
What the title card shows
Every data point on the article's title card, in text.
- 15 million. The records advertised in the Telegram listing of 18 September 2026, at 1.10 GB, described by the ministry as supposedly attributable to Aeroméxico.
- 100,092. The sample of records the ministry says it obtained and will analyse.
- 24 days. From the airline's Mexican disclosure of 21 September 2026 to 15 October 2026, with no filing furnished to the SEC in that period.
- 21 March 2025. The date of the decree in the Diario Oficial de la Federación that extinguished INAI and moved its functions to the Secretaría Anticorrupción y Buen Gobierno.
Frequently Asked Questions
Who is investigating the Aeroméxico data?
Mexico's Secretaría Anticorrupción y Buen Gobierno, a federal government department headed by Raquel Buenrostro Sánchez. It said on 20 September 2026 that it would open an investigation of its own motion after its forensic monitoring located a Telegram listing.
Why is a ministry doing this rather than a data protection authority?
A decree published in the Diario Oficial de la Federación on 21 March 2025 extinguished INAI, the autonomous institute that held the function, and transferred its responsibilities to the Secretaría Anticorrupción y Buen Gobierno.
Has the ministry concluded the data came from Aeroméxico?
No. Its statement is hedged throughout, describing a system that "could be related" to the airline and a database "supposedly attributable" to it. It makes no finding of a breach or of responsibility.
Has Aeroméxico reported anything to the SEC?
Its most recent filing on EDGAR under CIK 1561861 is the Form 6-K furnished on 22 September 2026, which concerned its share price. As at 15 October 2026 nothing further has been furnished and the annual report has not been amended.
What does the airline say?
That it is investigating the authenticity, origin and extent of the data, that it has not identified exposure of financial information, payment cards or passwords including for Aeroméxico Rewards users, and that operations are unaffected. It has acknowledged a 2025 event on a platform run by an outside supplier.