MJets listed on Inc Ransom leak site

• Ransomware group: Inc Ransom
• Country: Thailand
• Sector: Transportation
• Announcement date: August 15, 2025

The Inc Ransom group has listed data allegedly belonging to MJets on their leak site. According to an announcement made on August 15, 2025, the threat actor claims to have obtained the institution's data following an attack that reportedly occurred on July 4, 2025.

The claimed attack and event details

The incident involves a claim by the Inc Ransom group regarding a breach at MJets. The threat actor's announcement, posted on August 15, 2025, asserts that the group successfully infiltrated the organization. This claim is linked to a specific timeline, with the group stating that the initial attack took place on July 4, 2025.

Ransomware groups often utilize leak sites to host stolen data as a method of public pressure. This tactic is a hallmark of modern cyber extortion, where the threat actor moves from simple encryption to the threat of public disclosure. By listing an organization on a leak site, the group aims to increase the visibility of the breach to coerce the victim into meeting their demands.

Data types involved in the alleged breach

The announcement made by the Inc Ransom group claims that the stolen information includes a variety of sensitive materials. The group asserts that the data contains information belonging to a significant number of individuals, alongside corporate documentation. Specifically, the claim includes the following types of data:

• Personal data of more than 1500 people
• Financial information
• Internal files

While the specific volume of files and the exact amount of data taken have not been disclosed by the group, the claim highlights a mix of individual and corporate information. Such a combination of data types is frequently targeted by cybercriminals to maximize the leverage they hold over a target organization.

About MJets

MJets is a private aviation company based in Thailand. The company provides private jet charter, aircraft management, and was the first fixed-base operator (FBO) in Thailand.

Analysis and industry implications

This incident appears consistent with the Inc Ransom group's strategy of using double extortion to pressure organizations. In a double extortion scenario, attackers not only encrypt an organization's systems but also steal sensitive data, threatening to release it publicly if a ransom is not paid. The alleged exposure of personal and financial data may create secondary risks for employees and customers, such as identity theft or targeted phishing attacks.

Furthermore, the disclosure of operational data in the aviation sector could negatively impact the organization's commercial reputation and supply chain security. Given the sensitive nature of aviation services, maintaining the integrity of operational data is critical for maintaining trust within the industry. It is also likely that the organization may face legal obligations under data protection regulations in Thailand due to the alleged exposure of personal information.

Given the group's past activities, it is assessed that if the ransom demand is not met, the data may continue to be shared publicly. This ongoing threat of disclosure is a primary driver for organizations to invest in robust cybersecurity frameworks. To defend against such threats, organizations typically focus on implementing multi-factor authentication, maintaining offline backups, and conducting regular security awareness training to mitigate the risk of initial access via phishing.