Key points

• Mexican media and international reporting indicate that a SEDENA-led operation in Tapalpa, Jalisco—supported by bilateral intelligence cooperation with the U.S.—reportedly killed CJNG leader Nemesio Oseguera “El Mencho,” alongside seven alleged cartel members, with two arrests and the seizure of heavy weaponry and armoured vehicles.
• Within hours, authorities and media reported “narcobloqueos” (roadblocks) and vehicle fires across multiple states (including Jalisco and Michoacán), prompting state-level alerts and transport disruptions, including highway closures.
• Reprisal-style attacks expanded beyond road disruption into arson against businesses and public-facing infrastructure (e.g., multiple attacks in León, Guanajuato and reported damage to Banco del Bienestar branches in Jalisco).
• Aviation and diplomatic impacts were immediate: multiple airlines cancelled/suspended service to Puerto Vallarta (PVR) and Guadalajara (GDL), while several governments issued shelter-in-place/travel security alerts.

Analysis

Security dynamics (operations, reprisals, and target selection)

On 22 February, a SEDENA-led military operation in Tapalpa, Jalisco, reportedly killed the leader of the  Jalisco New Generation Cartel (CJNG), Nemesio Rubén Oseguera Cervantes (aka “El Mencho”), and seven alleged CJNG members and led to two arrests; authorities reportedly seized weapons, including rocket launchers described as capable of downing aircraft and destroying armoured vehicles. The operation was allegedly carried out with support from U.S. intelligence—a politically sensitive detail given that US President Donald Trump warned in January that the United States might need to “take action” regarding Mexico. He said he had asked President Claudia Sheinbaum whether she wanted U.S. military assistance to help dismantle drug cartels. The statement was made right after the operation to capture the Venezuelan President Nicolás Maduro on 3 January 2026. 

The CJNG retaliation pattern is notable for its breadth and multi-modal disruption. Roadblocks with fires were reported across a wide list of states (including Jalisco and Michoacán), and Jalisco authorities reportedly activated a “red alert” while suspending public transportation until control was restored. The México–Morelia highway closure after vehicles were set on fire demonstrates how quickly this tactic can sever key corridors and create secondary security risks (stranded travellers, unpredictable rerouting, and potential opportunistic crime at chokepoints).

Commercial and civic-facing targets were also hit. In León, Guanajuato, authorities reported multiple arson incidents affecting businesses and vehicles across several neighbourhoods, with reports linking the attacks to the events in Jalisco. Separately, at least 20 Banco del Bienestar branches in Jalisco were reported to have been attacked/damaged, indicating a willingness to strike highly visible public-service infrastructure to amplify disruption and signal reach.

Violence and road disruption were not confined to the CJNG’s core areas: Sinaloa also saw road blockades and vehicle fires in multiple municipalities (including Mazatlán/Villa Unión), reportedly cleared later the same day—highlighting a fast surge/partial normalisation cycle typical of coercive mobility denial.

Transport/aviation disruption and travel risk

The most immediate operational impact for travellers was aviation interruption concentrated on PVR and GDL. Puerto Vallarta airport reported that all international flights and most domestic flights were cancelled, while stating facilities were under National Guard/Defence protection. 7 Multiple carriers issued cancellations/suspensions, including Air Canada and Volaris at PVR. American Airlines also cancelled flights to/from PVR and GDL and offered rebooking flexibility through 24 February, explicitly tying the decision to insecurity on access routes. Aeroméxico cancelled services across several regional airports (PVR, GDL, Manzanillo, Tepic), and Viva warned of disruptions due to blockades at airport entrances—consistent with a tactic that targets “last-mile” access rather than airport perimeters alone.

Diplomatic signalling and societal disruption

The U.S. Embassy issued an initial security alert on 22 February covering multiple states and advising avoidance of law-enforcement activity areas, sheltering, and monitoring local news. On 23 February, a further update expanded shelter-in-place guidance across multiple locations (including Guadalajara, Puerto Vallarta and several Quintana Roo tourist areas) and imposed movement restrictions on U.S. government staff, including a directive not to travel to Mazatlán through 25 February. Canada and France also issued alerts advising confinement/caution in affected states, reinforcing that the perceived threat environment rapidly crossed the threshold for formal consular risk communications. Spain’s Consulate General in Guadalajara announced closure on 23 February as a preventive measure. Costa Rica’s migration alert for flights originating from Mexico indicates regional concern about potential cross-border flights by cartel-linked individuals following the reported leadership loss.

Domestic disruption extended into education: classes were suspended across multiple states on 23 February, explicitly tied in reporting to blockades and the reported death of “El Mencho.”

Outlook and practical travel advice (near-term)

Given the scale of same-day roadblocks, arson, and airport access disruption following the reported Tapalpa operation, further short-notice mobility restrictions and attacks on high-visibility civilian infrastructure (retail chains, transport nodes, public-service facilities) remain plausible while security operations continue. Travellers should avoid attempting to reach airports by road during active incidents, expect rolling flight cancellations and rebooking windows, and follow consular guidance on sheltering/avoiding security-force activity areas.