Short answer
Grupo Xcaret said records from 21 October 2026 in its park sales systems were accessed without authorization, exposing contact details of about 8,300 customers. The company says no bank or card data was taken and warns that fraudsters may send fake payment requests for reservations.
If you think your details were included, start with our checklist on what to do after a data breach.
Key facts
| Organization | Grupo Xcaret |
|---|---|
| Incident type | Data breach |
| Status | Confirmed by the organization |
| Sector | Tourism and theme parks |
| Country | Mexico |
| Detected | 2026-10-21 |
| Disclosed | 2026-10-24 |
| People or records affected | About 8,300 customers who bought park packages |
What data was exposed
- Email addresses
- Mobile phone numbers
What the company said
Grupo Xcaret, which runs parks and tours around Cancún and the Riviera Maya, told media that third parties reached its park sales systems through “mecanismos de comunicación no autorizados” (unauthorized communication mechanisms). The affected records date from 21 October 2026, according to Milenio, which reported the statement on 24 October.
Xcaret put the number at about 8,300 customers. It says the case is “bajo control” (under control) and that the customers involved were contacted one by one.
Why the scam warning matters
Contact details are enough for a convincing fake. El Imparcial reports that some customers have already received emails and text messages that may be attempts to collect reservation payments in their name. The company repeated that it “nunca envía ligas de cobro” (never sends payment links) by text.
Someone who booked a trip months ahead is a good target. A message that looks like a payment reminder, arrives soon after the leak and carries a link needs only one tap to do harm. Read our guide on urgent payment scams and on phishing messages.
What is not known
According to La Verdad Noticias, Xcaret has not said how the access happened, how long it lasted, who was behind it, or whether a complaint was filed with authorities. None of the articles we read names an attacker or a regulator involved. We found no claim of responsibility.
The company’s statements are the only confirmation so far. If more details come out, such as additional customers or other data fields, this page will be updated.
If you booked with Xcaret
Check any message about a reservation against your original confirmation email. If a sender, number or link does not match, do not engage. For the wider checklist, see what to do after a data breach, and browse other cases in the breaches index.
Scams to watch for after this breach
Criminals use breach news as cover. Expect messages that mention the incident, quote real details, or offer help.
- Fake payment links sent by SMS or WhatsApp to 'complete' or 'confirm' a park reservation. Xcaret says it never sends payment links by text.
- Emails from lookalike addresses posing as Xcaret sales staff, asking for a deposit or a corrected payment.
- Fake 'booking problem' calls that push you to pay quickly, a common pattern in tourism fraud.
What to do if you are affected
- 01Ignore any payment request about a park reservation that does not come from reservaciones@xcaret.com, reservations@xcaret.com or cotizaciones@xcaret.com.
- 02Do not open payment links received by text message. Xcaret says it does not send them.
- 03If you booked recently, check your reservation through the official Xcaret website or the contact details printed on your confirmation, not through a message you received.
- 04If you paid a fake request, call your bank right away to dispute it and ask for the card to be blocked, then report it to your state's cyber police unit or the Guardia Nacional.
- 05Never share passwords, card numbers or codes sent to your phone with anyone who contacts you unprompted.
Frequently asked questions
What data did the Xcaret breach expose?
Email addresses and mobile phone numbers, according to the company. It says no financial data such as bank accounts or payment cards was compromised.
How many Xcaret customers were affected?
About 8,300 customers who bought park packages. Xcaret says this is less than 0.003% of the records it handled in 2026.
How will Xcaret contact me about the breach?
Xcaret says affected customers were contacted individually. Treat any other message about a reservation payment with caution and check the sender address.
Is a Xcaret payment link by text message real?
Xcaret says it never sends payment links by SMS. Official sales emails come only from reservaciones@xcaret.com, reservations@xcaret.com and cotizaciones@xcaret.com.
Sources
- Hackeo a Grupo Xcaret: filtran datos de más de 8 mil clientes (Hack at Grupo Xcaret: data of more than 8,000 customers leaked), Milenio, 2026-10-24
- Filtran datos de 8 mil 300 clientes de Xcaret tras hackeo (Data of 8,300 Xcaret customers leaked after hack), El Imparcial, 2026-10-26
- Hackean sistema de Xcaret; exponen datos de 8,300 clientes (Xcaret system hacked; data of 8,300 customers exposed), La Verdad Noticias
This post summarises public reporting as of 2026-10-30. Details of live incidents change; we update posts when the organization or regulators publish new facts. Spot an error? See our editorial and corrections policy.