Do Son 
Hackers have breached the systems of GlobalX Air, an airline heavily utilized by the Trump administration for deportation flights, claiming to have stolen sensitive data—including passenger lists and flight routes for all operations, including those tied to controversial deportations of migrants. Among the compromised information are details of flights connected to the high-profile case involving the expulsion of Venezuelan nationals, carried out even as attorneys sought to halt the process through the courts.
A message posted on the airline’s website, allegedly from the hacktivist collective Anonymous, declared: “Anonymous has decided to enforce the Judge’s order since you and your sycophant staff ignore lawful orders that go against your fascist plans.” The post concluded with the line, “You lose again Donnie.” Anonymous, widely known for its politically charged cyber actions, has a long history of claiming responsibility for protest-driven intrusions.
Without prior solicitation, the hackers reached out to journalists, supplying copies of the stolen data spanning from January 19 to May 1. The dataset contains exhaustive details of each flight: schedules, passenger lists with passport data, routing information, and flight numbers. Particular attention was drawn to flights 6143, 6145, and 6122, which departed on March 15 from Harlingen, Texas. These flights are central to a class-action lawsuit filed by five Venezuelan plaintiffs against the Trump administration—a case currently before the U.S. Supreme Court.
Court records indicate that on that very day, attorneys attempted to secure a temporary restraining order against the deportations. Yet federal representatives claimed—“astonishingly,” in the court’s words—that they had no knowledge of any scheduled flights. When pressed by the judge, government attorneys cited “potential national security concerns” and refused to disclose further details in the presence of the media. Meanwhile, during a court recess, flights 6143 and 6145 reportedly departed around 5:25 and 5:45 p.m., respectively—corroborated by the stolen flight logs.
One especially troubling case involves 24-year-old Heymar Padilla Moyetones, who was deported via flight 6143 from Texas to Honduras, then mistakenly rerouted on flight 6144 to El Salvador, before being returned to Texas the same day. Her account, which she shared with NBC News, precisely matches the entries in the compromised database.
404 Media conducted cross-verification and confirmed that the names of migrants previously mentioned in deportation reports do, in fact, appear in the logs, linked to specific flights. However, due to the presence of passport and other sensitive personal information, the full lists have not been publicly released. The newsroom is currently working to confirm which individuals were directly tied to deportation operations.
Both GlobalX and ICE have not responded to media inquiries. The Immigration and Customs Enforcement agency maintains a \$128 million contract with CSI Aviation, which subcontracts GlobalX—expected to receive \$65 million annually. In 2024 alone, GlobalX aircraft accounted for 74% of ICE deportation flights—more than 1,500 operations—according to reporting by the Project on Government Oversight.
The hacker claimed that access was obtained via an active developer token linked to GlobalX, which in turn led to credentials for the company’s AWS cloud storage, where the flight data resided. They allege that portions of the data were later deleted and a message was sent to company personnel. A second message was reportedly delivered through NAVBLUE—an Airbus platform used by pilots for flight planning. As proof, the hackers shared screenshots demonstrating access to both NAVBLUE and GlobalX’s GitHub repositories.
The attackers emphasized that their actions were in response to a May 1 ruling by U.S. District Judge Fernando Rodriguez, who found that the administration had violated the law by invoking the Alien Enemies Act to justify deportations without due process. The defacement of GlobalX’s website, they asserted, was a direct response to this judicial precedent.
