In the wake of the 22 February operation against CJNG leadership, nationwide retaliation and fragmentation are rapidly altering Mexico’s risk landscape for businesses and travelers.
|
February 25, 2026 INSIDE THIS ARTICLE, YOU'LL FIND: |
Following the 22 February federal operation targeting CJNG leadership, Mexico experienced one of the most rapid and widespread cartel retaliations in recent years—forcing security leaders to reassess traveler risk, movement protocols, and near-term operational exposure.
Within hours of the operation, CJNG retaliated at national scale. Violence spread across more than 20 states, with over 300 confirmed blockades involving vehicle burnings, tire spikes, armed confrontations, and attacks on infrastructure. Airlines suspended flights into Guadalajara and Puerto Vallarta, municipalities closed schools and government offices, and the U.S. Embassy issued shelter-in-place guidance in multiple cities. The speed and geographic reach of the response underscored the cartel’s ability to disrupt movement, commerce, and public confidence across Mexico. As Global Guardian Director of Intelligence Michael Ballard noted, the scale of the retaliation “caught everyone off guard—including the Mexican government and military,” highlighting how rapidly cartel networks can mobilize under pressure.
Cartel retaliation following leadership targeting is not new. What made the 22 February response notable was the scale and speed of the disruption. Blockades and coordinated attacks are intended to create operational chaos, slow security force deployments, and project continued strength in the aftermath of high-level arrests or killings. By igniting simultaneous incidents across multiple states, CJNG demonstrated its capacity to mobilize quickly and impose nationwide disruption within hours.
The immediate objective was pressure—on federal authorities, on public confidence, and on rival criminal actors—and the broader message was unmistakable: the removal of leadership would trigger visible and widespread consequences. However, the longer-term implications may be less about public retaliation and more about internal instability.
Leadership targeting rarely produces stabilization. More often, it accelerates fragmentation. As Global Guardian Senior Intelligence Analyst Tomás Michael Carvallo noted during the webinar, “when someone like El Mencho is taken out, the cartel never disintegrates.” Instead, power reshuffles—often violently—among regional commanders with competing interests. CJNG operates through powerful regional commanders with varying degrees of autonomy, and the removal of senior leadership increases the likelihood of internal power struggles, competition over trafficking corridors, and opportunistic expansion by rival groups seeking to exploit uncertainty.
Unlike some cartel structures built around tight familial succession, CJNG’s leadership network is geographically dispersed and economically independent. Without a universally recognized successor, fragmentation is a credible scenario.
As fragmentation unfolds, longstanding territorial arrangements can weaken. Businesses that once operated under predictable—if informal—criminal dynamics may find those assumptions eroding. In contested regions, fixed commercial assets, logistics corridors, and foreign-owned infrastructure become more exposed as factions compete for control and revenue.
While the removal of CJNG leadership represents a tactical success for Mexican forces supported by U.S. intelligence, its strategic implications remain uncertain. Cartel leadership losses rarely dismantle underlying networks. More often, they trigger adaptation and short-term instability before a new equilibrium emerges. Whether this operation meaningfully degrades CJNG’s long-term capabilities—or simply reshuffles them—will become clearer in the months ahead.
Overland movement remains the most vulnerable variable during active disruption. Blockades are designed to paralyze mobility, complicate emergency response, and amplify uncertainty. Even after roadblocks are cleared, flare-ups can re-emerge in areas where security forces continue targeted operations or where factions seek to reassert control. Secure transportation, dynamic routing, and real-time monitoring were emphasized not as extraordinary measures, but as baseline safeguards in a fluid environment.
A consistent theme during the briefing was the importance of tactical pause in the first 12–24 hours of a rapidly evolving crisis. In the immediate aftermath of 22 February, movement carried extreme risk. Leaders were urged to resist pressure to “move immediately” and instead assess whether waiting 12–24 hours could materially reduce risk exposure. In high-velocity events, restraint often reduces risk more effectively than rapid action. During the webinar, Global Guardian CEO Dale Buckner framed the decision starkly: “Is accelerating movement in the first hours of chaos worth the potential loss of life?” In many crises, that tactical pause is what ultimately reduces exposure.
Air travel disruptions, while temporary, highlighted how localized violence can cascade into broader logistical friction. Flight cancellations into Guadalajara and Puerto Vallarta reflected precautionary responses to instability on the ground. Organizations were advised to build flexibility into travel planning and reassess exposure in western and northern states historically tied to CJNG operations.
From a duty of care perspective, panelists emphasized reviewing shelter-in-place criteria, evacuation triggers, and cross-border workforce exposure. The events of 22 February also reinforced a foundational leadership question: were you able to quickly identify, account for, and communicate with all personnel in Mexico? In fast-moving crises, the difference between awareness and control often comes down to having both a clear crisis response plan and the capabilities to execute it—real-time travel tracking, facility visibility, mass communication tools, and on-the-ground response resources that allow organizations to move from uncertainty to action within minutes.
Border cities are currently experiencing heightened security presence, which may suppress short-term instability. However, continued leadership targeting or internal cartel competition could introduce renewed volatility in these corridors. The key takeaway: Assumptions about “stable” regions must be continuously revalidated.
The overarching message: Risk conditions remain regional and dynamic—not uniform nationwide—and can shift quickly as operations and criminal responses evolve. As Global Guardian CEO Dale Buckner emphasized during the webinar, “We would never issue a blanket statement to not travel to Mexico. It’s a state-by-state, city-by-city assessment that can change quickly—but if you have a plan and an apparatus behind you, you can operate safely.”
Panelists also cautioned against relying on unverified social media reporting during crises. In the hours following the operation, false reports of attacks on Americans and airport incursions circulated widely online. Criminal groups have historically used disinformation to amplify fear and complicate response efforts. Panelists cautioned that false reporting circulated rapidly in the first hours of the crisis, reinforcing the importance of validating information through trusted intelligence channels. In rapidly evolving situations, validated ground reporting and trusted intelligence channels are critical to informed decision-making.
During the live session, attendees focused on regional stability, tourism safety, border exposure, and the trajectory of cartel violence. Below is a consolidated summary of documented questions and responses.
Mexico City
Q: What is the security outlook for Mexico City?
A: No significant concerns at the time of the briefing. The capital was not directly impacted by the retaliation.
Q: Should business travel to Mexico City proceed?
A: Yes. Travel within established secure zones may proceed using secure transport.
Baja California & Border Regions
Q: Why has Baja California Sur remained relatively stable?
A: The region is largely influenced by the Sinaloa cartel and CJNG does not have major influence in that region.
Q: Are border towns currently lower risk due to security deployments?
A: Temporarily yes, though volatility could increase if additional leadership targeting of other powerful organized crime groups occurs.
Q: What is the near-term outlook for border areas?
A: Conditions are stable for now, but these regions are economically critical to organized crime groups and can shift quickly. Continuous monitoring is advised.
Quintana Roo & Tourism
Q: Are corporate events or travel to Quintana Roo advisable?
A: No sustained or large-scale disruption was reported, and enhanced security presence has helped stabilize conditions. For corporate events or group travel, secure transportation, vetted venues, and contingency planning are recommended to mitigate localized volatility.
Q: Is it safe to move around Cancún by car or to/from the airport?
A: Secure transportation is recommended for any movement outside of the Cancún Hotel Zone.
Escalation & Fragmentation
Q: Do we anticipate violence flaring up again?
A: Smaller-scale flare-ups are possible as fragmentation unfolds, though a repeat of February 22’s nationwide disruption is less likely in the immediate term.
Q: Which cartels could be targeted next?
A: Groups on the U.S. State Department’s Foreign Terrorist Organization (FTO) list include Cártel de Jalisco Nueva Generación (CJNG), Cártel de Sinaloa, Cártel del Noreste (formerly Los Zetas), Gulf Cartel, La Nueva Familia Michoacana, and Carteles Unidos.
Q: Are Western expats being directly targeted?
A: There is no current indication of systematic targeting of Western travelers or expats. The primary risk remains collateral exposure during cartel or security force engagements.
The events of 22 February reinforce a broader reality: Mexico’s security landscape is increasingly shaped by leadership targeting, cartel fragmentation, and rapid retaliatory tactics. The risk environment is regional, dynamic, and capable of shifting quickly as criminal actors adapt.
For organizations operating in Mexico, resilience depends on secure movement protocols, clear escalation thresholds, continuous monitoring, and trusted operational partnerships capable of responding in real time. Preparedness is not about predicting the next incident—it is about ensuring that when disruption occurs, teams can move decisively from awareness to action.
Global Guardian will continue monitoring developments and providing updates as conditions evolve.
The security situation in Mexico remains fluid. Leadership targeting, cartel fragmentation, and retaliatory violence can rapidly shift operating conditions across regions—sometimes within hours. For organizations with personnel, travel, or commercial exposure in Mexico, timely intelligence and disciplined decision-making are essential.
To hear directly from Global Guardian’s intelligence and operations leaders—including detailed regional assessments, traveler risk considerations, and practical guidance on movement planning and duty of care protocols—view the full webinar: Mexico Security Situation: CJNG Retaliation & Traveler Risk.
Whether your organization is managing in-country teams, evaluating upcoming travel, or reassessing response thresholds in light of evolving cartel dynamics, this session provides actionable insight to support informed, real-time decision-making.
The Global Guardian team is standing by to support your security requirements. To learn more about our security services, complete the form below or call us at + 1 (703) 566-9463.