Key Takeaways
- On February 22, 2026, Mexican military forces killed CJNG cartel leader “El Mencho,” triggering immediate retaliatory violence — including roadblocks, arson and infrastructure attacks — across as many as 28 states.
- The leadership vacuum left by El Mencho’s death is expected to fuel internal power struggles within CJNG and embolden rival organizations like the Sinaloa Cartel, sustaining elevated violence well beyond the initial unrest.
- Organizations with people, facilities or supply chains in Mexico should act now: account for all employees in affected regions, restrict non-essential travel and review business continuity plans.
On February 22, 2026, a high-level Mexican military operation resulted in the death of Nemesio Rubén Oseguera Cervantes — known as “El Mencho” — the leader of the Jalisco New Generation Cartel (CJNG). The operation has triggered widespread retaliatory violence, including coordinated “narcobloqueos” (criminal roadblocks), arson and attacks on infrastructure across as many as 28 Mexican states.
Organizations with personnel, facilities, or supply chains in Western, Central and Northern Mexico should prepare for a sustained period of instability. Internal CJNG succession struggles, combined with opportunistic actions by rival criminal organizations, are likely to drive continued violence, operational disruption and elevated risk to personnel.
What Happened
On the morning of February 22, Mexican military forces executed a planned operation to capture El Mencho in the municipality of Tapalpa, Jalisco, a known CJNG stronghold. During confrontations with security forces, Oseguera Cervantes was seriously injured and later died while being transported to Mexico City.
Within hours, organized criminal groups initiated coordinated retaliatory actions across multiple states. These actions are consistent with historical patterns following cartel leadership losses and have included:
- “Narcobloqueos” on major transportation corridors
- Arson targeting vehicles, commercial establishments, gas stations, and public infrastructure
- Coordinated attacks against law enforcement, military forces, and government officials, including targeted assassinations
- Disruption of public services and municipal operations
Federal and state security forces have deployed reinforcements to affected regions, with efforts focused on containing violence, restoring access to critical transportation routes and reestablishing public order.
CJNG maintains operational presence across approximately 28 states and is assessed to be one of the most powerful drug trafficking organizations globally. The U.S. Department of State has issued shelter-in-place guidance for U.S. citizens in affected areas, including Puerto Vallarta, Guadalajara, and other municipalities in Jalisco, Tamaulipas, Michoacán, Guerrero and Nuevo León. Multiple commercial airlines have suspended or curtailed operations at Puerto Vallarta and Guadalajara airports.
What Comes Next
The death of El Mencho creates a significant power vacuum within Mexico’s most influential criminal organization. CJNG operated under a highly centralized command structure, and the organization is likely to experience increased factionalism, internal conflict and territorial fragmentation in the near term.
In the short term, the security environment is expected to remain highly volatile. Rival organizations — most notably the Sinaloa Cartel — are expected to probe for territorial and operational vulnerabilities. This transition period increases the likelihood of localized violence, targeted attacks and elevated “cobro de piso” (protection tax) demands as competing factions seek to consolidate authority. Violence is likely to be unevenly distributed, with periodic flare-ups rather than a rapid return to baseline security conditions.
What This Means for Companies Operating in Mexico
Organizations should anticipate prolonged security-related disruptions affecting daily operations, workforce mobility and supply chains. Personnel in affected regions face increased risk of kidnapping, assault, extortion or incidental exposure to violent events.
Cross-border logistics may experience delays as Mexican authorities prioritize security operations in border regions and U.S. authorities increase scrutiny of northbound traffic. Even outside primary conflict zones, organizations should expect heightened security measures, including military checkpoints, transportation delays and the potential for localized curfews — particularly near government facilities and tourist areas.
Given the evolving threat environment, non-essential employees in affected areas, including Mexico City, should work remotely where operationally feasible.
Recommended Actions
Employee Accountability. Immediately establish real-time accountability for all expatriate and locally assigned employees in affected regions. Ensure personnel understand reporting and check-in requirements during periods of elevated risk.
Enroll in U.S. Government Notification Programs. U.S. citizens traveling or residing in Mexico should enroll in the Department of State’s Smart Traveler Enrollment Program to receive timely security updates and facilitate emergency contact.
Review or Exercise Business Continuity Plans. Review and, where appropriate, exercise business continuity and crisis management plans specific to Mexico-based operations.
Restrict Non-Essential Travel. Reassess and restrict non-essential travel to high-risk states or regions until the threat environment stabilizes.
Maintain Ongoing Situation Reporting. Provide employees and senior leadership with regular threat updates summarizing changes in risk exposure, violence trends and operational impacts.
Organizations should maintain close coordination with relevant foreign affairs departments, local security providers and embassy resources, and strictly adhere to official government guidance as the situation continues to evolve.
Brian Hess is a senior director and George Fields is a director in Security Risk & Resilience at The Chertoff Group.
