Avianor Aircraft listed on Hunters ransomware leak site

• Ransomware group: Hunters
• Country: Canada
• Sector: Transportation
• Announcement date: February 10, 2024

Hunters ransomware group targets Avianor Aircraft

The ransomware group known as Hunters International has officially listed the Canadian aviation company Avianor Aircraft on its dedicated leak site. According to the announcement made by the threat actors, the group claims to have successfully exfiltrated a significant amount of data from the organization's infrastructure. While the group's post focuses on the theft of information, they notably stated that their activities did not involve the encryption of the organization's systems during this specific incident.

This type of activity is a hallmark of modern cyber extortion tactics. In many contemporary ransomware campaigns, threat actors move beyond simple encryption to a method often referred to as double extortion. In these scenarios, attackers focus on stealing sensitive information before or instead of locking files, using the threat of public exposure to pressure the victim into paying a ransom. Even when no encryption occurs, the mere threat of leaking proprietary or personal data can cause significant operational and reputational distress for the targeted entity.

Details of the claimed data exfiltration

The announcement by Hunters International, posted on February 10, 2024, provides specific details regarding the scale of the alleged breach. The group claims that the stolen dataset is substantial in both volume and file count. While the specific nature or content of the files has not been explicitly detailed by the attackers, the scale of the theft is evident from the metrics provided in their announcement.

The group claims the following regarding the compromised data:

• Total data size of 849.7 GB
• A total of 578,914 files

The presence of such a large volume of files suggests a wide-reaching access to the organization's digital environment. As is common with these types of leaks, the specific categories of information—such as whether they include financial records, employee details, or technical blueprints—remain unconfirmed by the group's public post, though screenshots provided by the attackers indicate the massive scale of the file collection.

About Avianor Aircraft

Avianor Aircraft is a specialized aviation company based in Canada. The organization provides a wide range of critical services within the aerospace industry, specifically focusing on interior modifications, maintenance, repair, and overhaul (MRO) services. These services are provided for both commercial and military aircraft, highlighting the company's role in a high-stakes sector. Furthermore, Avianor specializes in the complex processes of design, manufacturing, and certification of aircraft cabins, making them a key player in aviation infrastructure and safety compliance.

Risk assessment and industry implications

This incident poses a significant risk regarding the potential exposure of sensitive corporate or customer data held by Avianor Aircraft. Because the organization is based in Canada, any confirmed breach of personal information may fall under the regulatory scope of the Personal Information Protection and Electronic Documents Act (PIPEDA). Such regulatory oversight ensures that companies are held accountable for how they protect the data of their clients and employees.

Beyond regulatory concerns, the breach introduces secondary risks. For the employees and customers of Avianor Aircraft, the leaked data could potentially be used for identity theft or targeted phishing attacks. For the organization itself, the leakage of data can lead to a loss of commercial reputation and cause various operational disruptions that may impact their ability to serve the aviation sector.

The threat actor behind this claim, Hunters International, is a group that emerged in 2023. Analysts assess that the group is derived from Hive code. It has been reported that the group announced the cessation of its encryption activities in 2025. Despite changes in their operational methods, the threat of data exfiltration remains a primary concern for organizations in the transportation and aviation sectors, which often handle highly sensitive technical and personal information.

To mitigate such risks, organizations in the aviation and transportation sectors typically focus on robust defensive measures. These include implementing strict access controls, enhancing monitoring of data egress to detect unauthorized transfers, and maintaining comprehensive incident response plans to manage the fallout of a potential data leak.