MRO Aerospace targeted by CRPxO ransomware group

• Ransomware group: CRPxO
• Country: United States
• Sector: Manufacturing
• Announcement date: July 27, 2026

The aerospace and defense services provider MRO Aerospace has been listed on a ransomware leak site by the threat actor group known as CRPxO. According to the announcement made on July 27, 2026, the group claims to have successfully infiltrated the organization's network infrastructure and exfiltrated a significant volume of sensitive information.

The alleged attack and claims by CRPxO

The threat actor group CRPxO asserts that they have gained unauthorized access to the network infrastructure of MRO Aerospace. Following this infiltration, the group claims to have exfiltrated 87.3 GB of sensitive data from the organization. The group has stated that the stolen information includes critical files such as defense contracts, financial records, and various types of employee information.

In a move characteristic of modern double extortion tactics, the threat actor has announced that the stolen data will be published publicly if their ransom demands are not met. In such scenarios, ransomware groups typically use the threat of data exposure to pressure victims into paying, moving beyond simple encryption to focus on the reputational and legal damage caused by a data leak. While the specific ransom amount has not been disclosed by the group, the threat of public disclosure remains the primary leverage in this incident.

The scope of the claimed data exfiltration

The information allegedly stolen by CRPxO is extensive and covers multiple critical business and personal domains. The group claims to have access to a wide array of sensitive documentation and credentials. The specific types of data mentioned in the leak site announcement include:

• Defense contracts
• FAA certification records
• Accounting ledgers
• Bank statements
• Tax filings (W-2, 1099)
• Employee HR records (SSN, I-9)
• Customer contact databases
• Technical drawings
• Inventory management data
• VPN access credentials

The inclusion of technical drawings and inventory management data suggests that the breach may extend into the operational and engineering aspects of the company, while the presence of VPN access credentials poses a continuous security risk to the network infrastructure.

About MRO Aerospace

MRO Aerospace is an organization providing maintenance, repair, and overhaul (MRO) services for the aerospace and defense industry. The company specializes in technical support and supply chain management for aircraft components.

Impact assessment and industry implications

The alleged exfiltration of data related to the defense industry may pose significant risks to national security and supply chain integrity. Because the organization operates within the highly regulated aerospace and defense sectors, the exposure of such data can have cascading effects on various stakeholders. Furthermore, the exposure of employee Social Security Numbers (SSN) and tax forms could increase the risk of identity theft for the affected individuals.

Given that the company holds FAA and DOD certifications, this incident may trigger investigations by regulatory authorities and could potentially lead to compliance penalties. Additionally, the leaked VPN and network credentials could be leveraged by the threat actors or other malicious entities to conduct secondary attacks against the organization's systems.

For organizations operating in high-stakes sectors like aerospace and defense, maintaining robust security postures is essential. Common defensive steps to mitigate such risks include implementing multi-factor authentication (MFA) to protect access credentials, maintaining strict network segmentation to prevent lateral movement, and conducting regular audits of supply chain security. Additionally, comprehensive monitoring of network traffic can help detect unauthorized data exfiltration attempts before large volumes of data can be moved out of the environment.