aurora ransomware group lists Metrea LLC/Commuter Air Technology, Inc. on its leak site
The threat group known as aurora has listed Metrea LLC and its subsidiary Commuter Air Technology, Inc. on their leak site, claiming to have obtained sensitive data.
- Published
- 3 min read
- 3 min read
- Ransomware group: aurora
- Country: United States
- Sector: Transportation
- Announcement date: September 5, 2026
The aurora group claims a data breach against Metrea LLC and Commuter Air Technology, Inc.
The threat group known as aurora has listed Metrea LLC and its subsidiary, Commuter Air Technology, Inc., on their leak site. The group claims to have obtained sensitive data belonging to the organization, marking a significant potential exposure for a key player in the defense supply chain.
This incident follows a common pattern observed in modern cyberattacks, often referred to as double extortion. In such scenarios, threat actors not only encrypt an organization's systems to disrupt operations but also exfiltrate sensitive information. The attackers then threaten to leak this data on public forums or dedicated leak sites if their demands are not met. This tactic places immense pressure on organizations, as the exposure of confidential data can lead to long-term reputational, legal, and operational damage that persists even if systems are restored from backups.
Details of the alleged data theft
On September 5, 2026, the aurora group officially listed the organization on their leak site. The group claims to have acquired a wide array of highly sensitive materials, including military tactical radio firmware, operational personnel data, and various defense contract documentation. These claims suggest that sensitive information regarding the company's defense projects and special operational processes may have been compromised.
The specific data types allegedly included in the leak are highly sensitive and involve critical military and personnel information. According to the group's claims, the stolen data includes:
- Military tactical radio firmware
- Personnel files
- Social Security Numbers (SSN)
- Training certificates
- Security clearance documentation
- Contract pricing data
- Operational deployment schedules
Furthermore, the group asserts that the stolen information contains Harris PRC-117G military tactical radio firmware and ITAR-controlled waveforms. The leak is also said to include deployment schedules for over 14 operators, SIPRNet access documentation, and SOCOM contract pricing portfolios. Additionally, the group claims to have obtained 232 employee personnel files and documentation regarding training exercises for specialized units, specifically SEAL Team Six, MARSOC, and the 75th Rangers.
About Metrea LLC and Commuter Air Technology, Inc.
Metrea LLC and its subsidiary, Commuter Air Technology, Inc., are defense contractors that provide specialized services to the military. They provide Intelligence, Surveillance, and Reconnaissance (ISR) aircraft services for the US Special Operations Command. The company operates modified King Air 350 aircraft to provide logistics and technical support in various global operational theaters.
Implications and defensive considerations for the defense sector
This incident may pose significant risks to the operational security of a contractor within the defense supply chain. The alleged compromise of ITAR-controlled data and military training documentation could present sensitivities regarding national security. The exposure of employee personal data, such as Social Security Numbers and personnel files, may lead to identity theft and targeted phishing attacks against the affected personnel.
Furthermore, the disclosure of contract pricing could undermine the company's competitive position and potentially trigger legal or regulatory scrutiny. For organizations operating within the defense sector, such incidents highlight the critical importance of robust cybersecurity frameworks. Protecting sensitive technical data, such as radio firmware and controlled waveforms, is essential to maintaining the integrity of military operations.
To mitigate such risks, organizations in this sector often implement rigorous access controls, multi-factor authentication, and continuous monitoring of their networks. Protecting the personal information of employees is equally vital to prevent targeted social engineering attacks. As threat actors continue to target the defense supply chain, maintaining high standards of data encryption and strict adherence to regulatory requirements remain essential defensive pillars. Information regarding the aurora group remains limited.