Grupo Xcaret reports systems breach

Grupo Xcaret said its sales systems were breached and that contact information and mobile phone numbers were taken from some customers. The company said financial data, bank accounts and payment cards were not compromised.

What did the company say about the scope?

Grupo Xcaret’s position, cited by Grupo Animal, says the incident affected contact information and cell phone numbers, but did not expose payment methods. Expok, meanwhile, reported that about 8,300 records would represent less than 0.003% of the total processed by the company during 2026, according to the company itself.

The company also reportedly contacted potentially exposed customers before making its position public, according to Expok. In the same statement, it said it acted in line with current law.

What did the company recommend in the event of possible fraud?

Grupo Xcaret warned that it does not send payment links by text message and pointed to official booking and quote channels as a safeguard against possible fraudulent requests. The recommendation is intended to reduce the risk of third parties using the extracted data to attempt scams through messaging.

Separately, La Verdad de Tamaulipas published recommendations for users after a personal data leak, although the available result does not precisely identify the breach, the responsible party or the number of affected users. Suggested steps include changing passwords for email, online banking and social media, and enabling two-factor authentication.

That kind of protection matches the preventive response that often follows the exposure of contact data, even though in this case the company ruled out any compromise of financial information. Based on the available information, the reported exposure was limited to personal data, and the company moved to contain possible misuse afterward.