Grupo Xcaret confirms leak of 8,300 customers

The platform for managing human risk in cybersecurity.

Grupo Xcaret confirms leak of 8,300 customers

Xcaret confirmed unauthorized access to sales systems and the exposure of emails and phone numbers for 8,300 customers, plus fake charges.

Whalemate Labs · AI-assisted researchFederico HombreNov 9, 202634 min read

Grupo Xcaret confirmed unauthorized access to its park sales systems and the extraction of contact data for about 8,300 customers. The affected set, the company said, was below 0.003% of its annual records, and the compromised data was limited to email addresses and mobile phone numbers. Available coverage did not report exposure of bank accounts, payment cards, or other financial data.

The company dated the incident to records corresponding to October 21, 2026. Public notification appeared between October 24 and 27 in different Mexican media outlets. Xcaret also said the case was under control, that affected customers had been contacted individually, and that it had already identified fake messages and emails aimed at charging for reservations in its name. It added that it does not send payment links by SMS and that its official sales channels use reservaciones@xcaret.com, reservations@xcaret.com, and cotizaciones@xcaret.com.

The public record supports describing the incident as a limited intrusion or abuse of communication mechanisms within the parks' sales environment, but it does not allow a precise reconstruction of the intrusion technique, the duration of access, the affected vendor, or the full forensic sequence. There are also no IOCs, samples of fraudulent messages, domains, hashes, IP addresses, or public evidence of action before authorities. Some coverage says the exposed data could be reused in later fraud attempts, but that appears as a risk or possibility, not as confirmed access to banking information or credentials.

Executive summary

Grupo Xcaret confirmed unauthorized access limited to its park sales systems, with contact data taken from about 8,300 customers and a later alert about fake messages attempting to charge reservations in its name. According to the company, the affected records corresponded to October 21, 2026, and represented less than 0.003% of its annual records. The compromised information was limited to email addresses and mobile phone numbers, with no public evidence of exposure of bank accounts, payment cards, or financial data.

Available coverage places detection and public disclosure between October 24 and 27, 2026. The company’s core message was consistent across the reports reviewed, the case was under control, affected customers had been contacted individually, and no one should respond to charges by phone, SMS, or email unless they came from official channels. Xcaret also reminded customers that it does not send payment links by text message and identified its valid sales accounts as reservaciones@xcaret.com, reservations@xcaret.com, and cotizaciones@xcaret.com.

From a technical standpoint, the material points to an incident centered on unauthorized communication mechanisms inside the sales environment, with a primary goal of contact-data exfiltration and a secondary goal of impersonation fraud. Even so, the research does not publish IOCs, does not identify a vendor, does not describe the exact intrusion technique, does not confirm persistence or lateral movement, and does not document a forensic analysis or formal coordination with authorities. That gap limits reconstruction of the attack chain to a descriptive level and requires separating confirmed facts from hypotheses about later fraudulent reuse.

The regional scope is narrow and, in the available material, centered on Mexico. No additional verified facts were found for Argentina, Chile, Paraguay, Bolivia, Peru, Colombia, Brazil, the United States, or Uruguay. The operational lesson that does hold is that the risk does not end with the leak of email addresses and phone numbers, because those details are enough to support phishing, smishing, and impersonation calls tied to reservations. The material does not show that the abuse escalated into credential theft or financial access, but it does show that Xcaret issued preventive warnings to contain that vector.

Context and background

The Grupo Xcaret case emerged through a short sequence of Mexican media reports published between October 24 and 27, 2026. The reported timeline is consistent on one central point, the incident involved the parks' sales systems and affected contact data linked to reservations or sales. Based on what was published, there is no evidence that the compromise reached other corporate environments, or that it affected park operations, payment databases, or third-party reservation infrastructure.

The company said the affected records corresponded to October 21, 2026. That date serves as a time anchor for ordering the incident, but it does not by itself show when the intrusion began, how long the actor remained in the environment, or the exact moment of exfiltration. Nor does the public record say whether the exposure came from stolen credentials, an integration flaw, unauthorized internal access, or some combination of those mechanisms. The only relatively stable technical detail in coverage is the reference to unauthorized communications within the sales systems used exclusively by its parks.

The reports also agree that the exposed information was limited to email addresses and mobile phone numbers. That detail matters because it narrows the room for later abuse. With those two attributes, a malicious actor can design targeted fraud campaigns, but does not necessarily gain direct access to bank data or authentication credentials. That is why several reports clearly separate the leak of contacts from any suggestion about passwords or payment methods, and the company itself denied that those data were compromised.

The public material also shows a response focused on customer communication. Xcaret said the case was under control and that it had contacted the people involved individually. At the same time, it warned that it does not send payment links by SMS and asked customers to ignore payment requests sent by calls, messages, or emails outside its official channels. That response fits a scenario in which the contact dump quickly became fuel for impersonation fraud, although the research does not provide samples of those messages or an independent technical analysis of their content.

Key facts table

Date	Event	Source	Confidence
2026-10-21	Grupo Xcaret said the affected records corresponded to October 21, 2026.	La Jornada, El Financiero	Confirmed
2026-10-21	The company attributed the incident to unauthorized access or unauthorized communication mechanisms within sales systems used exclusively by its parks.	Crónica, El Financiero	Confirmed
2026-10-21	Contact data for about 8,300 customers was extracted.	La Jornada, Crónica	Confirmed
2026-10-21	The compromised information consisted of email addresses and mobile phone numbers.	La Jornada, Crónica	Confirmed
2026-10-21	The affected records represented less than 0.003% of the year’s total records.	La Jornada	Confirmed
2026-10-24	Xcaret warned about fake emails and SMS messages that tried to charge reservations in its name.	La Jornada	Confirmed
2026-10-24	The company listed official sales accounts, reservaciones@xcaret.com, reservations@xcaret.com, and cotizaciones@xcaret.com.	La Jornada, Reportur	Confirmed
2026-10-24	CISO Club dated Xcaret’s notice to October 24, 2026 and linked the exposed data to reservations.	CISO Club	Confirmed
2026-10-25	Xcaret said the case was under control and that the affected customers had been contacted individually.	El Financiero, Capital México	Confirmed
2026-10-25	The company said no financial data were compromised, including bank accounts and payment or card data.	24 Horas	Confirmed
2026-10-25	Some reports said fraudulent charges were being attempted in Xcaret’s name, with no public IOCs or technical analysis.	24 Horas	Attributed by source as uncertain
2026-10-26	El Imparcial suggested as a possibility that attackers later tried to obtain passwords, bank data, or other personal information through new fraud messages.	El Imparcial	Attributed by source as uncertain
2026-10-27	Crónica confirmed the incident was tied to park sales systems and repeated the type of data extracted.	Crónica	Confirmed

Operation timeline

Date	Event	Actor/vector	Verified source
2026-10-21	Unauthorized access or unauthorized communication occurs in park sales systems.	Unidentified actor, sales systems	La Jornada, Crónica, El Financiero
2026-10-21	Email addresses and mobile phone numbers are extracted from about 8,300 customers.	Contact-data exfiltration	La Jornada, Crónica
2026-10-21	The company classifies the impact as below 0.003% of its annual records.	Internal assessment disclosed by the company	La Jornada
2026-10-24	Xcaret publicly discloses the incident and warns about fake charge messages.	Corporate notice, fraudulent SMS and email	La Jornada, CISO Club
2026-10-24	The company publishes its official sales emails and asks customers to ignore charges through unofficial channels.	Containment and prevention response	La Jornada, Reportur
2026-10-25	The company says the case is under control and that customers were contacted individually.	Corporate communication	El Financiero, Capital México
2026-10-25	Reporting says no financial data were compromised.	Negative-scope statement	24 Horas
2026-10-27	Crónica reinforces the chronology and the link to park sales systems.	Journalistic timeline validation	Crónica

Xcaret Case Timeline — Milestones published between October 21 and 27, 2026.

Attack chain and TTPs

The public material does not allow a full attack chain to be reconstructed, but it does narrow the kind of operation involved. What is confirmed is unauthorized access or use of unauthorized communication mechanisms within park sales systems, followed by extraction of customer contact data. From there, the clearest later phase was impersonation fraud, with fake messages and emails that sought to charge reservations.

There is no published evidence of exploitation of specific vulnerabilities, initial phishing, credential theft, session abuse, persistence, privilege escalation, or lateral movement. Nor are there any known tools, infrastructure, or domains. The research does not include samples of the fraudulent messages, so it is not possible to identify technical indicators or tie the content to a broader campaign.

In TTP terms, the cautious reading is this. First, an unspecified access vector against the sales environment. Second, contact-data exfiltration, likely for later fraud use. Third, Xcaret impersonation through SMS or email, a pattern that matches phishing and smishing aimed at customers with reservation context. The last link is only partially documented, because the company said it had identified fake messages, but the material does not provide public forensic proof of that abuse.

Incident workflow — Reconstructed technical sequence using only confirmed facts.

TTP	Description	Source
Unauthorized access	Unauthorized entry or use in sales systems used exclusively by the parks.	El Financiero, Crónica
Contact exfiltration	Extraction of email addresses and mobile phone numbers from about 8,300 customers.	La Jornada, Crónica
Brand impersonation	Fake messages and emails that tried to charge reservations in Xcaret’s name.	La Jornada, Reportur
Use of unofficial channels	Recommendation not to respond to payment requests by calls, SMS, or emails outside official channels.	La Jornada
Possible later fraud	Some coverage suggests possible attempts to obtain passwords or other data, but without technical confirmation.	El Imparcial

Case TTP Matrix — Observable tactics and techniques in public documentation.

Regional impact

The regional reading of the case is almost entirely Mexican. The research does not show geographic spread, there is no verified impact outside Mexico, and no victims appear in other countries in the editorial series. What does appear is a second-layer regional effect, because the extraction of contact data is a typical input for cross-border fraud by message or email, even if that expansion was not documented in the confirmed facts.

Regional overview

The incident remained confined to Mexico in terms of verifiable coverage. The reported scale, 8,300 customers out of a larger annual base, is relatively small statistically, but not trivial for targeted fraud. With email addresses and phone numbers, an attacker can run fake charge campaigns that resemble legitimate communications from a tourism brand with strong regional recognition. That is the operational risk Xcaret tried to cut off with its public warning and the publication of official channels.

Mexico

Grupo Xcaret said in Mexico that the affected records corresponded to October 21, 2026, that the extracted data were email addresses and mobile phone numbers, and that about 8,300 customers were affected. The company said the scope represented less than 0.003% of its annual records. It also said the incident was under control, that the affected individuals had been notified, and that no financial data were compromised.

The Mexican public response added a second layer of impact, impersonation fraud. Xcaret warned about fake messages and emails that tried to charge reservations in its name, clarified that it does not send payment links by SMS, and provided its official sales accounts, reservaciones@xcaret.com, reservations@xcaret.com, and cotizaciones@xcaret.com. Some reports said those data may already have been used in fraudulent charge attempts, but that point is not backed by IOCs or public technical evidence.