February 2026 Mexico Security & Risk Analysis

On February 22, 2026, a federal military operation in Tapalpa, Jalisco, killed Nemesio Oseguera Cervantes — El Mencho — the founder and supreme leader of the Cartel Jalisco Nueva Generación. The operation simultaneously seized detailed CJNG financial ledgers from his compound, exposing the organization's revenue architecture at the moment of its command collapse. The death triggered a pre-programmed contingency protocol: within hours, coordinated roadblocks and vehicle burnings erupted across at least 20 states, producing more than 252 documented blockades, at least 60 confirmed fatalities including 25 National Guard members, and the temporary paralysis of commercial transport, aviation, and public services across large portions of the country. The disruption lasted approximately 72 hours at peak intensity before federal deployments restored order on primary corridors.

The structural damage to CJNG extends well beyond El Mencho's death. The organization's financial architecture — built around a tight family network that controlled revenue remittance from plaza bosses across Mexico — had been systematically dismantled over the preceding two years. Key figures including his wife, his brother, his son, and his principal logistics operator were arrested, extradited, or eliminated before or alongside the February 22 operation. There is no financial headquarters. There is no command chain capable of sustaining the revenue model that held the organization together.

The full monthly Mexico Security & Risk Analysis, including an accompanying third-party summary podcast, is available by subscription.

HARARY SECURITY SITUATION ANALYSIS

Two hundred fifty-two blockades across 20 states on Sunday. By Monday morning, virtually nothing.

That is not a government suppression victory. That is an organization that lost its reason to fight overnight.

Here's what likely happened.

CJNG's financial architecture was the most centralized of any Mexican cartel. El Mencho controlled the money through a tight family network: his wife Rosalinda as financial operator, his brother-in-law Abigael González Valencia running Los Cuinis (CJNG's entire financial and logistical arm), his brother Antonio handling logistics. Every regional cell remitted revenue upward to Guadalajara.

That network has been systematically destroyed. Abigael extradited to the U.S. Antonio taken into U.S. custody. Rosalinda arrested. Jessica convicted on Treasury financial charges. El Mencho's son extradited. And now El Mencho himself is dead.

There is no financial headquarters. There is no one to pay the plaza bosses. There is no one to pay for the retaliation.

So the regional commander in Tamaulipas or Oaxaca or Guanajuato wakes up Monday morning and does the math: burn another bus for a dead leader and a headquarters that no longer exists, or keep the extortion revenue that was previously flowing to Guadalajara.

That's not a hard calculation.

The retaliatory protocol on Sunday was pre-programmed — activated reflexively by cells following standing orders. But sustaining coordinated nationwide violence requires ongoing command, logistics, and payment. None of those exist anymore.

What comes next is not peace. What comes next is fragmentation. Every former CJNG plaza boss is now an independent operator. Territorial boundaries that were arbitrated from the top no longer have an arbiter. The cell next door is now a competitor for the same extortion targets, the same trafficking corridors, the same local rackets.

Every major cartel decapitation in Mexico has followed this pattern. The Beltrán Leyvas. The Zetas. The Sinaloa Cartel after Mayo Zambada. Spectacular retaliatory violence gives way to grinding, localized turf wars that last months or years.

The silence you're hearing right now across Mexico is not stability. It's the sound of scores of regional operators doing the math on their own futures.

For companies operating in Mexico, the risk profile just shifted. The threat is no longer a single coordinated organization. It's an unknown number of smaller, less predictable ones fighting over the pieces.

Subscribe to our full report for full details and analysis.

Twenty states. Two hundred fifty-two blockades. Fourteen dead. That was Mexico on February 22.

The retaliatory response to El Mencho's killing was not a regional event. It was a nationwide demonstration of organizational reach.

Within hours of the Tapalpa raid, CJNG cells activated coordinated retaliation across nearly two-thirds of Mexico's states. Armed men torched a Costco in Puerto Vallarta. Gas stations were set ablaze in Guadalajara. Pharmacies and convenience stores burned in Guanajuato. Buses were commandeered and ignited on the Trans-Isthmic highway in Oaxaca. Freight associations advised suspending all cargo movement on Mexican highways.

By evening, the U.S. Embassy had expanded its shelter-in-place advisory three times. The final version covered Jalisco, Baja California, Quintana Roo, Tamaulipas, Michoacán, Guerrero, Guanajuato, Oaxaca, and Nuevo León. All U.S. government staff at Consulate Tijuana were ordered to shelter. So were all U.S. personnel in Guerrero, Michoacán, and Quintana Roo.

That last point matters. Cancún, Cozumel, Playa del Carmen, and Tulum — Mexico's Caribbean tourism engine — were placed under formal U.S. security advisory. Twelve embassies issued warnings to their nationals. Every major airline serving western Mexico cancelled flights.

The commercial disruption tells its own story. Scotiabank and Santander closed branches across five states. Walmart activated emergency customer hotlines. Intercity bus lines ETN-Turistar and Estrella Blanca shut down. Universities from UNAM to UDLAP suspended in-person classes. Mexico's industrial association explicitly warned against moving any freight.

Here's what hasn't happened yet: clarity on succession.

CJNG operated under El Mencho's autocratic, centralized control for 15 years. His family pipeline is destroyed — wife, daughter, son, brother, brother-in-law all arrested or extradited. No heir apparent has emerged. Regional plaza bosses now face a choice: consolidate under new leadership or fracture.

Every precedent says fracture. Every precedent says the violence gets worse before it gets better.

Mexico has 90 days to stabilize Guadalajara before the World Cup. The Sheinbaum government has the biggest counter-narcotics result in a decade — and the hardest question the country has faced in twenty years.

Harary Security Group issued our second situation update to clients this morning. If your organization has operations, personnel, or supply chain exposure in Mexico and needs expert assessment, reach out directly.

Our full reports are available by subscription.

Mexican Army Special Forces killed Nemesio Oseguera Cervantes this morning in Tapalpa, Jalisco. "El Mencho" founded and led the Jalisco New Generation Cartel, which the DEA considers at least as powerful as the Sinaloa Cartel, with presence in all 50 U.S. states and estimated assets of $50 billion.

He had evaded capture for over a decade despite a $15 million U.S. bounty—the highest active reward for any Mexican drug trafficker.

His death is the most consequential blow to a major Mexican criminal organization since El Chapo's capture in 2014.

Within hours, retaliatory violence erupted across 13 states. Road blockades and vehicle burnings hit Jalisco, Michoacán, Guanajuato, Tamaulipas, Baja California, Colima, Guerrero, Nuevo León, Aguascalientes, Nayarit, Oaxaca, Puebla, and Zacatecas. An active shooter situation was reported at Guadalajara International Airport. Puerto Vallarta was described as under siege. Pharmacies and convenience stores were burned in Guanajuato.

The U.S. Embassy issued shelter-in-place orders for five states. Air Canada suspended Puerto Vallarta flights. Jalisco activated Code Red emergency protocols, suspended all public transit, and closed schools for Monday.

Here is what matters for anyone with business exposure to Mexico:

This does not end CJNG. It destabilizes it. CJNG's family leadership structure has been systematically dismantled—wife arrested, daughter imprisoned in the U.S., son extradited, brother-in-law captured. With the leader now dead and no clear successor, the most probable outcomes are internal fragmentation, succession violence, and rival encroachment into contested territories across western and central Mexico.

History is instructive. Every major cartel decapitation in Mexico has produced a net increase in violence as factions splinter and competitors rush to fill vacuums. The Sinaloa Cartel after El Chapo. The Beltrán Leyva Organization. The Zetas. The pattern is consistent.

The states to watch over the coming weeks: Michoacán, Guanajuato, Colima, and Nayarit, where CJNG battle lines were already fluid, and rivals were already probing.

One additional dimension that will attract enormous attention: Guadalajara is scheduled to host four FIFA World Cup matches starting in June. Today's events—active shooter at the airport, burning vehicles across the city, Code Red activation—will force a security reckoning for the tournament.

For companies operating in Mexico, this is not a one-day event. This is a structural shift in the threat environment that demands immediate review of security posture, travel protocols, and crisis response readiness.

Our full reports are available by subscription.

Mexico recorded 90 homicide victims in the first 48 hours of 2026 and at least 39 on a single day, January 9. While national data show intentional homicides trending more than 30 percent below the peaks of mid-2024, January demonstrated that the decline coexists with entrenched pockets of extreme violence, sophisticated criminal logistics, and persistent institutional vulnerability across at least a dozen states.

Five developments stood out: 

• First, the Salamanca football-field massacre killed 11 and wounded 12 in front of families, followed days later by a second mass killing in the same community that left seven dead, cementing Guanajuato as the country's most dangerous theater of indiscriminate violence. 

• Second, the kidnapping of 10 workers from a Canadian-owned silver mine in Concordia, Sinaloa, forced the suspension of operations and triggered a federal surge of nearly 2,800 military and security personnel, exposing the direct economic cost of cartel conflict to foreign investment. 

• Third, authorities transferred 37 high-profile cartel figures to U.S. custody and arrested priority targets including Sinaloa-linked "El Mantecas," CJNG plaza boss "El Uber," and Michoacán extortion architect "El Botox," marking one of the most operationally productive months for binational enforcement in recent years. 

• Fourth, the dismantling of a Tren de Aragua cell in Mexico City revealed the deepening reach of transnational Venezuelan organized crime inside the capital.

• Fifth, criminal groups deployed explosive-laden drones in Guerrero, improvised explosive devices in Sinaloa, and a landmine in Michoacán, confirming the escalation toward military-grade tactics by non-state armed groups.