The 1.10 GB Aeroméxico Breach: A Warning for Football's Hidden Data Infrastructure

1.10 GB. That is the size of a data set reportedly being offered for sale on Telegram under the name Aeroméxico, Mexico's national airline. The data set is said to contain more than 15 million records; a sample of 100,092 records was reviewed, containing names, emails, phone numbers, mobile numbers, dates of birth and registration dates. A Mexican federal anti-corruption and good-governance authority opened an ex officio investigation, meaning it acted on its own initiative without a prior complaint. For its part, the airline stated that financial data, payment cards and passwords were not exposed, and that operations were unaffected. The origin and authenticity of the data set remain unconfirmed, and the investigation is ongoing. At this point many readers wonder what an airline data leak has to do with football. The answer lies exactly where few want to look: football's own data infrastructure. When the pitch closes, I open the market ledger — and that ledger is now mostly stored in bits, not on paper. Football runs on an invisible data network Modern football does not run on legs alone. It runs on fan databases, membership records, ticketing data, broadcast-rights data, player medical records, scouting data, and above all the entire chain of deal documents. Every one of those data points connects to a third-party vendor — where the security fence is often far thinner than the club's own walls. A breach at a large corporation is not merely a reputational story. It is a structural signal. When an airline holds a vast customer base, a dense commercial partner network and sponsorship contracts spanning many industries, a vulnerability there travels along exactly the path that sponsorship money takes. Football sits at the end of that path more often than people think. Sponsorship money flows from corporation to club, from club to league, from league to broadcasters and data firms. The risk travels with the money; nobody simply stands up to measure it. What is striking is that most of a club's commercial value today is measured in data, not in physical assets. Brand value, engagement levels, international audience files, ticket and shirt conversion rates — all are indicators that are collected, stored and resold. When the input data source is compromised, the output value is questioned. A sponsor pays to reach a verified audience file; if that file can be leaked or faked, the contract loses part of its foundation. Where the evidence chain of a deal actually lives I make my living reading documents. The evidence of a deal is not in official letters; it is buried in two signatures. Release clauses, signing fees, instalment structures, performance bonuses, image rights, agent commission splits — all exist as files. When those files sit inside the system of an intermediary with weak security, negotiation leverage changes hands. Imagine a negotiation's data leaking before signing day. The rival knows the real budget. The player knows he is the backup option. The agent knows the ceiling the club can still push to. Each such leaked fragment does not produce a goal, but it bends the entire valuation cycle. A shot makes a goal; a cycle makes value — and that cycle is now recorded in digital data. Whoever holds that data chain holds the power to price. The agent ecosystem is where the most sensitive data concentrates. A mid-sized agency may manage dozens of players' files, along with contracts, commission-sharing terms and payment schedules across multiple parties. They often have no dedicated information-security team, sharing cloud storage services at minimal cost. This is the blind spot, because the agent holds information before the club does. The payroll is where people finally tell the truth, and where it is most dangerous The payroll is where people finally tell the truth. In any club, the figure paid to each player reflects the real power order, not the order that gets spoken. When the payroll leaks, what is exposed is not a few rows of numbers but the entire hierarchy of the dressing room. A player who learns a teammate earns three times more may react in ways no dressing room wants. That is why clubs have a structural incentive to limit the scope of disclosure when an incident occurs. Look at how Aeroméxico handled it: a statement that financial data, payment cards, passwords and operations were unaffected. That is a template for limiting damage scope. Clubs use exactly that template whenever a data incident occurs: cordon off, reassure, await investigation. The issue is not whether such a statement is true or false. The issue is that trust can only be confirmed after the investigation ends, while the moment when answers were needed has already passed. From Mexico, looking at the transfer market The Aeroméxico case reveals three risk layers football has not quantified. First, customer and fan data: names, emails, phone numbers, dates of birth — raw material for targeted fraud. Then partner-relationship data: sponsor lists, contract terms, payment schedules — core commercial assets. And finally operational data: schedules, internal records, processes — which a leak can erode trust in. In the transfer market, all three layers exist. Fan data sits with ticketing offices and digital platforms. Partner data sits with commercial departments and agents. Operational data is scattered across scouting, medical and legal departments. No club fully controls all three, because each layer is usually run by a different vendor. As scouting moves to cloud platforms and medical records move to electronic files, the number of contact points rises while the number of people genuinely accountable for security falls. A counterintuitive blind spot: the attacker is not the weakest link The reflex of the crowd is to blame the hacker. But football's weakest link is not the attacker; it is the silent intermediary chain. There sit agents, ticketing vendors, data analytics firms, media companies — entities small enough to be overlooked and deep enough to reach real data. An outsourcing contract that saves a club a few percentage points of operating budget can open a vulnerability costing many times more. The second blind spot is that leaked information is sometimes worth more than money. In a deal, what decides is not the amount but who knows the amount first. For that reason, a leak in football may not make a loud noise, because the parties involved have reason to stay silent. A deal does not begin with an offer, but with a call nobody hears — and a leak begins in exactly the same place, in exchanges no official letter ever records. Who is holding the evidence A good reporter is not the one who arrives early, but the one who knows which waiting room is real. In a data incident, the real waiting room is the access log, the vendor contract, the timestamp. Aeroméxico says the origin and authenticity are unconfirmed. That is a standard line, but it is also a line that leaves every conclusion open. For football, the equivalent question will be: when a transfer file is leaked, who owns the evidence to prove what actually happened? For in this game, the party that reaches a conclusion fastest is rarely the party holding the evidence. Football's biggest data incident will not come from a circulated video, nor from a tapped call. It will come from a database nobody remembers owning. And when it comes, what gets repriced is not a player but the trust of an entire commercial system. The question is no longer whether it will happen, but when it does, who is holding the key — and whether your club knows it lost that key long ago.