Hacktivists breached deportation charter airline GlobalX and took flight manifests

Global Crossing Airlines, the Florida charter operator trading as GlobalX that has flown removal flights for US Immigration and Customs Enforcement, was breached in early May 2025 by hackers operating under the Anonymous banner.

404 Media reported on 5 May that the attackers had taken flight records and passenger manifests covering flights between 19 January and 1 May 2025, including deportation flights. The outlet said it verified the material by cross-referencing it against publicly known ICE flight information, among them a flight that carried Kilmar Abrego Garcia. A message left on a GlobalX web property accused the company and its staff of ignoring lawful court orders.

GlobalX made no public announcement of its own at the time. In a Form 8-K filed with the US Securities and Exchange Commission on 9 May 2025, the airline said it had detected unauthorised activity on 5 May within computer networks and systems supporting parts of its business applications.

The company said it had activated its incident response plan, engaged third-party cybersecurity experts to contain and isolate the affected servers, and informed law enforcement. It said it did not believe flight operations had been disrupted and that the scope of the incident was still under investigation. GlobalX did not confirm what data had been taken, so the account of exposed deportation manifests rested on the attackers' material and 404 Media's verification of it.