BH Aircraft Company, Inc. targeted by Rhysida ransomware group

• Ransomware group: Rhysida
• Country: United States
• Sector: Transportation
• Announcement date: February 12, 2025

Rhysida claims data breach at BH Aircraft Company, Inc.

The threat actor known as Rhysida has listed BH Aircraft Company, Inc. on its leak site, claiming a significant data breach. According to the announcement made on February 12, 2025, the group alleges that it has successfully exfiltrated a massive amount of information from the organization's systems. The group claims to have made approximately 1,211,995 files publicly accessible, representing a substantial volume of stolen data.

This incident follows the common pattern of modern ransomware operations, where threat actors move beyond simple encryption to focus on data exfiltration. In these scenarios, the attackers threaten to release sensitive information on public leak sites if their demands are not met. This tactic is often referred to as double extortion, a method designed to increase pressure on the victim by threatening the exposure of confidential corporate and personal information.

Details of the alleged data leak

The Rhysida group claims that the stolen dataset is approximately 778 GB in size. Based on the screenshots provided in the leak site announcement, the compromised information appears to include various documents related to the company's operational, commercial, and financial processes. The visual evidence provided by the attackers suggests that the breach has reached deep into the organization's internal documentation.

The specific types of data allegedly included in the leak are:

• Tax identification information
• Payment records
• Corporate documents

The presence of such documents, particularly tax-related forms, suggests that the breach may involve sensitive information belonging to more than just the corporation itself. When such data is leaked, it often exposes the personal or professional details of various stakeholders involved in the company's business activities.

About BH Aircraft Company, Inc.

BH Aircraft Company is a manufacturer providing leading-edge technology products and components for the aerospace and aircraft industries. The company specializes in precision manufacturing solutions, particularly for aircraft engines and structural parts. Operating within the highly specialized aerospace sector, the company provides critical components that are essential to the functioning of modern aircraft.

Potential impact and industry implications

The exposure of the claimed data could lead to the disclosure of highly sensitive financial and operational information. The inclusion of W-9 tax forms in the leaked data is particularly concerning, as it indicates that employees or business partners could be exposed to significant risks, such as identity theft. Because the company operates within the United States, such a breach may involve violations of data privacy obligations governed by relevant state laws and federal regulations.

In the aerospace and transportation sectors, the implications of such a breach can be broad. Beyond the immediate financial and regulatory risks, the leaked data could potentially be utilized by threat actors for secondary attacks. These include targeted phishing campaigns aimed at specific individuals or even supply chain attacks, where the compromised information is used to gain access to the company's partners or customers. When an organization is targeted by a double-extortion ransomware group, the risk of subsequent exploitation remains high even if the initial encryption is resolved.

To mitigate the impact of such incidents, organizations typically need to conduct thorough forensic investigations to determine the exact scope and depth of the breach. Identifying exactly what was taken and how the attackers gained access is a critical step in the recovery process. Furthermore, organizations often find it necessary to notify all affected parties, including employees and business partners, to allow them to take protective measures against potential identity theft or secondary cyberattacks.