15 Million Records Put Up for Sale: A Data Governance Test for Vietnamese Football

In late September 2026, a Telegram channel put up for sale more than 15 million passenger records from the airline Aeroméxico. The compressed file had a size of 1.10 GB and allegedly contained personal information of airline customers. This incident does not belong to football, but sports analysts cannot ignore it. It raises a straightforward question: if a major airline cannot protect customer data, what are Vietnamese clubs doing to protect player and internal data? The initial information from Mexico's Secretaría Anticorrupción y Buen Gobierno shows that the agency opened an investigation. Its representatives reviewed 100,092 records in the data sample, including names, emails, phone numbers, dates of birth and account registration dates. The authenticity of the entire database remains unconfirmed, and the origin of the leak has not been concluded. Aeroméxico confirmed it is cooperating, while denying exposure of financial data, payment cards and passwords. For this writer, the most notable message lies in how the investigators handled the case. They did not rush to trust the 15 million figure; they tested it with a concrete sample. In football, the same approach should be applied. Many V.League teams still make assessments based on vague statistics of unclear origin. Data does not lie, but it does not tell a story on its own. A number about passes completed or kilometres covered, taken out of context, is just a puzzle piece that can mislead. The Aeroméxico story suggests that sports organizations need to build internal data verification systems, much like the Mexican agency testing a data sample before drawing conclusions. Vietnamese football is undergoing digital transformation, but it lacks a common standard. Each club collects data its own way, stores it differently, and may not know who has access. When an incident happens, nobody accepts responsibility. As a result, players and fans carry the risk. On the surface, this is a security issue. But seen more deeply, it is a matter of accountability. A club holds data on hundreds of young players, including injury history, physical test results and scout assessments. If this data leaks, players are directly affected. Transfer negotiations can collapse, player morale can be damaged, and the trust of their families in the academy can be shaken. From a tactical perspective, data is not just physical numbers. It includes expected line-ups, pressing plans, and movement patterns in set pieces. Leaking this information before a decisive match can ruin an entire training plan. The ball is just a variable; the way it moves is the message. But when that message reaches the opponent before kick-off, the variable becomes a weapon against the club itself. I have followed many teams for more than three decades and witnessed how data changes preparation. In Spain, position analysis has become a prerequisite before every match. In Vietnam, many teams still treat data as a luxury. The gap is not only technological; it is a mindset gap. A club does not have to spend millions on GPS systems; it needs a clear policy on what data is collected, who is allowed to see it, and how long it is stored. Aeroméxico says no financial data or passwords were exposed. That statement may ease immediate concern, but it does not solve the root problem. This case shows that the line between personal data and sensitive data is fragile. Names, emails, phone numbers and dates of birth – seemingly harmless fields – can be used for targeted attacks, fraud or building a detailed picture of a person. In football, seemingly harmless data can be just as dangerous. A player's running output falling by two percent from last season could indicate an injury, or it could come from a flawed measurement. If a journalist uses that figure to conclude the player is declining, the story becomes distorted. Good data does not answer the question; it teaches us to ask better questions. Vietnamese sports media should learn to verify data before spreading it, instead of chasing sensational numbers. The Aeroméxico case also exposes a reality: media crises often start from an unverified claim. A false rumour about a key player's injury can create panic and destabilize the team's psychology. Responsibility lies not only with the club, but with those who report the news. Clubs need verification processes, and journalists need to check sources from two independent sides. Vietnamese football is entering a phase where academies use technology for scouting. Every training session of a youth squad creates a set of data: heart rate, distance run, number of sprints. If a connected device is breached, the whole database can be stolen. Attackers do not need to break into a large system; they only need to find an unencrypted laptop belonging to an assistant coach. This is a blind spot many smaller clubs fail to anticipate. At transfer time, medical and physical data become negotiation weapons. A club may value a player based on impressive numbers; but when data is manipulated or leaked, the club's credibility collapses. In this sense, data is no different from a player – it needs a clear contract, a protection process and an accountable owner. Vietnamese clubs should treat data as a strategic asset, not as paperwork stored on a computer. Instead of waiting for an incident, clubs should start with the smallest measures: regular password changes, access control, and storing sensitive data offline. It sounds basic, but most leaks come from human error, not technical sophistication. The Mexican investigation is still ongoing, and the authenticity of the 15 million records remains unconfirmed. While waiting for a conclusion, the football world can look at this case and ask: is our data system transparent? Who is responsible when data is leaked? An empty stadium does not erase the match; it strips away the excuses. A good data system does the same. When all excuses are removed, only process and operation remain. Vietnamese football needs those processes, not only to avoid risk, but to build trust for the next generation of players. The 15 million records put up for sale may not belong to football, but it raises a challenge. The national federation, clubs and youth training centres should sit down and review how data is collected. They need to answer one simple question: if our data were leaked today, how would we explain it? The clearer the answer, the greater the long-term advantage. A vague answer makes every written tactical plan fragile. A regular season is not decided by one match, but a data incident can destroy the effort of an entire season. It is time for Vietnamese football to see data as part of tactics, and data security as part of team discipline.