Cyber Incident Victim: Grupo Aeroportuario del Centro Norte
Date:
Oct 2024
Location:
Mexico
Summary
Grupo Aeroportuario del Centro Norte experienced a cybersecurity incident impacting its information systems, prompting an immediate response with security protocols and backup systems to maintain airport operations across its 13 locations. The company confirmed no significant service disruptions to users or material adverse effects on its financial position or operational results, though continuous monitoring and evaluation remain ongoing. A forensic investigation involving external cybersecurity experts is underway to determine the incident's scope and enhance future security measures, with no attribution or details regarding potential threat actors disclosed at this stage.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 0 motives | 0 techniques |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On October 1, 2024, Grupo Aeroportuario del Centro Norte (OMA) publicly disclosed a cybersecurity incident affecting its information systems, prompting an immediate investigation. The company, which operates 13 airports across Mexico—including major hubs in Monterrey, Acapulco, Chihuahua, Ciudad Juárez, and Zihuatanejo—activated established security protocols and contingency measures to mitigate operational disruptions. OMA confirmed its airport services continued functioning through alternative and backup systems, with no significant service interruptions reported for passengers. While the attack compromised primary information systems, the organization maintained continuous monitoring of its technological platforms throughout the incident. External cybersecurity experts were engaged to assist OMA's internal IT team in managing the breach and evaluating its scope. No operational shutdowns occurred at any facilities during the containment phase.
The forensic investigation initiated by OMA aims to determine the full extent of the security breach and identify vulnerabilities to prevent recurrence, though no timeline for completion was provided. Company statements emphasized preserving system integrity, confidentiality, and availability as primary objectives throughout the response. Financial disclosures indicated no material adverse effects on operations, earnings, or fiscal position as of the reporting date, with ongoing assessments planned until full resolution. OMA did not attribute responsibility for the attack or characterize it as isolated or coordinated, withholding details about attacker methodologies or potential data compromise. All airports remained operational with standard service levels maintained via contingency protocols during the investigation phase.