Teotihuacán attack: What happened and impact on travel risk in Mexico

The lone assailant, 27-year-old Mexican national Julio César Jasso Ramírez, opened fire with a .38 calibre revolver at the Pyramid of the Moon shortly after 11h20 (local time), held approximately dozens of visitors hostage, and took his own life after being cornered by National Guard and municipal police within 25 minutes. Two people were killed, including Ramírez, and 13 others were wounded, among them tourists from Canada, the United States, Brazil, Colombia, the Netherlands and Russia. 

What drove the Teotihuacán attack?

Mexican authorities have described the incident as premeditated and inspired by the 1999 Columbine High School massacre in the United States, which also took place on 20 April. Mexican President Claudia Sheinbaum and the Attorney General of the State of Mexico have explicitly ruled out any links to cartels, criminal groups or terrorism, instead attributing the incident to the perpetrator’s mental health issues and copycat behaviour. Ramírez had visited the site multiple times in preceding weeks, conducted reconnaissance and carried a backpack containing the revolver, 52 live cartridges, a tactical knife and materials directly referencing the 1999 Columbine High School massacre. While Ramírez voiced anti-foreign rhetoric, insulting tourists’ nationalities, the evidence points overwhelmingly to psychological instability and copycat behaviour rather than any coherent political or ideological agenda. 

What is the likelihood of a similar attack?

The incident was highly divergent and remains isolated; it does not signal a new wave of lone-actor extremism across the country. Security managers should therefore treat Teotihuacán-style threats as low-probability but high-visibility events that require targeted mitigation rather than changes to country-wide travel protocols. Nevertheless, residual disruption associated with a heightened police presence, additional checkpoints and strengthened surveillance is almost certain to be recorded at tourist sites and 2026 FIFA World Cup venues over the coming months. 

What are the longer-term implications for Mexico?

The attack will not fundamentally alter Mexico’s overall risk environment, which remains primarily defined by cartel and organised-crime risks. However, it has exposed vulnerabilities at high-profile soft targets such as archaeological zones, tourist attractions and major public events, where access controls and early detection are inherently limited. In response, President Sheinbaum has announced stricter security protocols at tourist sites ahead of the World Cup, including enhanced checkpoints and cyber-surveillance measures to identify potential threats. The rapid response by security forces in containing the incident and limiting casualties demonstrated an operational capability that will be critical ahead of the World Cup. 

Advice for organisations and travellers in Mexico

• Review visits to major archaeological zones and tourist sites in the coming weeks while enhanced security measures are implemented. Note that the National Guard and federal authorities have signalled increased cyber monitoring of potential copycat threats, which is likely to lead to temporary tightening of public-access protocols.
• Security managers should verify that existing contingency plans for tourist sites, archaeological zones and major public events such as the 2026 FIFA World Cup are actionable and account for lone-actor scenarios that differ markedly from cartel-related risks. Ensure that evacuation and medical contingency plans are current, include rapid extraction options from crowded venues, and account for possible short-notice access restrictions.
• Ensure employees are aware of nearest shelter locations and situational-awareness protocols at crowded venues. Brief staff on recognising suspicious behaviour, avoiding predictable routines and maintaining communication with local security teams so movement to safety can be actioned at short notice. If your company lacks specific protocols for sudden armed incidents at symbolic locations, engage your international assistance provider to coordinate with your Crisis Management Team (CMT) and update incident-response plans.
• Monitor local media, official government advisories and the Healix Risk Intelligence Portal for real-time updates on security posture at tourist locations and World Cup venues. Corroborate information through multiple channels and liaise with in-country contacts regarding access restrictions or heightened police presence.