Aeromexico admits a customer data breach: what to do if the employees of your Mexico operation fly with them

On September 22, 2026, Aeromexico admitted it had suffered a cyberattack and detailed which customer data was exposed, as reported by El Financiero (in Spanish). If people from your Mexico operation fly with them, this concerns you even if you have nothing to do with airlines.

This is not an aviation story. It is a checklist for the country manager, the finance lead or the IT person at headquarters who has staff in Mexico with corporate or Club Premier accounts and needs to know what to do this week.

What an attacker can do with traveler data

An airline breach rarely leaks your company passwords. It leaks something more useful to a scammer: context. Name, email, phone, frequent flyer number and, in the worst case, where someone travels and when. The exact fields are in the El Financiero piece.

That is raw material for targeted phishing. Phishing is a fake email or message that pretends to come from someone trusted in order to get a password or a payment. A generic one says “your account has been suspended”. A targeted one says “your Thursday flight to Monterrey was rescheduled, confirm here”. Your sales rep in Guadalajara clicks without thinking.

Then there is refund fraud: “you have a pending refund, enter your card to receive it”. And travel desk impersonation: someone calls the assistant in Mexico City who books the flights, knows real names and dates, and asks to change the card on file. In our experience that call is the one that gets through, especially when headquarters is in another time zone and nobody can be asked quickly.

What to do today

Step	Who does it	Time
Warn every traveling employee, with examples of fake messages	Local admin or HR	30 minutes
Change the Aeromexico password and any account where it is reused	Each employee	10 minutes per person
Turn on MFA for corporate email	IT or your Mexico IT provider	1 to 2 days
Review anti-phishing filters in Microsoft 365 or Google Workspace	IT or your Mexico IT provider	Half a day
Define how payment changes with agencies and airlines get confirmed	Management or finance	1 hour

MFA is multi-factor authentication: besides the password, email asks for a code on the phone or a physical key. If a scammer gets the password through a well-made phishing email, without the second factor they do not get in. How to set it up so phishing cannot bypass it is in how to protect the email of your Mexico operation.

Would your Mexican entity have to notify? The LFPDPPP

The LFPDPPP is Mexico’s federal privacy law for private companies. It requires any private company handling personal data in Mexico, including the local subsidiary of a foreign group, to protect the data it holds about customers and employees.

Today the notification is Aeromexico’s job. But it is worth asking the question the other way around: if your Mexican entity gets hacked tomorrow, would you have to notify? The law says yes when the breach significantly affects the financial or moral rights of the people involved. A shared spreadsheet with scanned passports, corporate cards and travel dates of your Mexico staff qualifies, no matter where your headquarters sits.

Why Mexico is in the crosshairs

This is not paranoia. Mexico accounts for 18% of corporate ransomware attacks in all of Latin America, according to Cadena Política. Ransomware is the attack that encrypts your files and demands payment to give them back. And 31% of SMBs in the region report financial losses from cyberattacks, as cited by ConNuestroPeru.

Most of those attacks start the same way: a believable email, a click and a password. A breach like this hands attackers the material to make that email believable. If the worst happens, what saves the day is described in backups in Mexico that actually restore.

Let’s talk

And in your Mexico operation?

If your people travel, you have three fronts: email, people and the payment procedure. All three can be reviewed in a week, in English or Spanish.

At ProcessBi we run the email security review in Microsoft 365 or Google Workspace, deliver short and practical anti-phishing training for your local staff, and our support plans include incident response. We work with foreign companies whose staff travel to or work in Mexico, with invoicing in MXN or USD.

Book your free review — we reply the same business day.