When Data Is Put Up for Sale: Football and the Fragile Lesson of Trust

On a Telegram channel, a 1.10 GB compressed file appeared like an item in a marketplace. The poster said it contained more than 15 million records: names, emails, phone numbers, mobile numbers, dates of birth, registration dates. Those records are alleged to belong to customers of Aeroméxico, Mexico's national airline. I read the line in a small apartment in Shenzhen, a half-finished documentary script about football beside me. Outside the window, the city still glowed. And I found myself thinking about something else: how a system that looks solid suddenly exposes the exact spot where it is thinnest. In 41 years in this profession, I learned that the most dangerous thing does not come from the loud collision. It is the quiet gap opening where you never expected it. A defence does not collapse from a long shot. It collapses from a pass into the one space no one on the pitch noticed. THE CONTEXT OF AN OPEN STORY According to published information, an anti-corruption and transparency body of the Mexican government — the Secretaría Anticorrupción y Buen Gobierno — opened an ex officio investigation, meaning it acted on its own initiative without waiting for a citizen complaint. The body said it would clarify three things: the extent of the data exposure, the origin of the dataset, and the responsibility of the parties involved. A sample of 100,092 records has been reviewed. Aeroméxico says no financial data, payment-card numbers, or passwords were exposed, and that operations were unaffected. The airline says it is cooperating with authorities and has stepped up technical monitoring. The notable thing is the gap. As of now, neither the authenticity of the leak nor the airline's reassurance has been independently verified. The origin is unclear. There is no conclusion. This is an open story, and that openness is exactly where the real story begins. I am not bringing this item in because it belongs to football. It belongs to another field. I mention it because it touches the very question football faces every day — only in a louder way. FOOTBALL PLAYS WITH DATA Modern football no longer plays with bare feet. It plays with data. Every passage of play now leaves a digital trace, and those traces have become an asset worth more than the ball itself. In 2026, a genuine data leak shook European football. Rui Pinto, a Portuguese man, collected and published millions of secret documents on transfer contracts, player wages, image rights, and the dealings of many major clubs. European media called it Football Leaks. For the first time, fans saw the real numbers behind closed contracts. And for the first time, people understood that football stores a vast amount of data but protects it with a fragile fence. Pinto was arrested in 2026, extradited to Portugal, and faced criminal charges. But whatever the final verdict, one thing changed: football knew it was being watched. Look a little wider. Clubs store the data of millions of supporters — names, seat numbers, ticket-purchase history, payment details. Leagues store players' biometric data: heart rate, distance covered, GPS coordinates, sleep. Betting companies collect data on every pass. VAR stores thousands of frames per match. Together they form a network where a single loose link exposes the whole system. Football became a data industry before anyone thought to name it. A big club today may have a whole analytics department of dozens of specialists, collecting data from ten-year-old academy players to the first team. A licensed European betting firm processes millions of data points every matchday. The value of those datasets lies not in their size but in the fact that they cannot be replaced. The Aeroméxico case teaches one simple thing: an attacker does not need to break down the door. He only needs to find the door nobody locked. THE BLIND SPOT OF COLLECTIVE MEMORY Our mistake when we talk about football data is thinking it is only about money. We worry about leaked contracts, about transfer figures laid bare, about commercial images exposed. But the thing most stolen, and least mentioned, is identity. Who among us ever thought that their date of birth, their phone number, the email they used to buy a ticket, could become a line in a 1.10 GB file? We guard the club's secrets, yet hand over our own identity to registration forms we do not read carefully. In football, people argue endlessly about VAR. They say it reduces mistakes. But look closely: it only moves the argument from the pitch into a closed room, where the rules are renegotiated in silence. Data is the same. It does not make everything more transparent. It only moves power into the hands of those who can read and control it. In 2026, when the Chinese Super League shut down for five months because of the pandemic, I got into the Shenzhen stadium — capacity 45,000 — and filmed 240 minutes of nothing but grass, empty seats, and a guard's whistle echoing in bursts. Management asked me to add simulated crowd noise. I nodded, then quietly did not. In the script I wrote about a ball rolling slowly through an empty goal, and called it a ritual without spectators. Yet even in that empty stadium, the servers still recorded everything. That is the blind spot of collective memory. We remember the goals, but forget that those memories are now stored on servers we do not own. THE WIND WAITS FOR NO ONE I once sat in the stands in Kazan in the summer of 2026, watching Kylian Mbappé, nineteen years old, tear apart the opposing defence with two bursts of speed inside four minutes. I dropped the approved script to follow him with the camera. The wind of Kazan that year taught me that youth never rolls slowly to schedule. And the night I read about that 1.10 GB file, I understood one more thing: data is the same. It waits for no one. It asks no permission. It simply passes quietly, leaving traces where we do not have time to look. In a world without spectators, football is left with only breath and truth. But that breath, that truth, is now recorded, encrypted, and can be sold to anyone who pays. WHAT REMAINS Football will not die from a data leak. It has survived wars, pandemics, and seasons with not a single spectator in the stands. But it will have to change how it lives if fans stop believing their identity is kept safe. Perhaps in a few weeks the investigation will conclude, and the story will fade like so many others. But somewhere, a boy is filling in an email to buy the first ticket of his life. We adults owe that boy a stadium where trust is not stolen. Sing it out, before some compressed file puts that voice up for sale.