Queretaro Intercontinental Airport confirms cyberattack claimed by LockBit

Queretaro Intercontinental Airport, known by the abbreviation AIQ, from its Spanish name Aeropuerto Intercontinental de Queretaro, and located in the central Mexican state of Queretaro, confirmed on November 1, 2023 that it had been the target of a cyberattack. The airport handled more than 1.1 million passengers in 2022 and serves as a significant cargo hub for routes within Mexico and to the United States and Europe.

Airport officials said the intrusion started when an employee downloaded a file containing malware. They said the response team had applied containment and isolation measures, that AIQ systems were operating normally and that operational security had not been compromised. The airport said the safety of passengers and operations remained its priority and that it had notified the relevant authorities.

The LockBit ransomware group listed the airport on its data leak site and threatened to publish material it claimed to have stolen unless a ransom was paid by November 27, 2023. The group did not disclose the amount it was demanding.

Officials played down the value of the stolen material, saying the information the attackers held was already in the public domain. Neither the airport nor Mexican authorities confirmed whether any systems had been encrypted, and no interruption to flight operations was reported.