Qube Aviation Catering targeted by CRPxO ransomware group

• Ransomware group: CRPxO
• Country: United States
• Sector: Transportation
• Announcement date: July 27, 2026

CRPxO claims data exfiltration at Qube Aviation Catering

The threat actor known as CRPxO has announced a significant data breach involving Qube Aviation Catering. According to an announcement made on a ransomware leak site on July 27, 2026, the group claims to have exfiltrated 22.5 GB of data belonging to the organization. This incident follows the group's claim of an attack occurring on the same date, July 27, 2026.

In modern cyberattacks, ransomware groups often employ a tactic known as double extortion. In this scenario, attackers do not merely encrypt a victim's files to disrupt operations; they also steal sensitive information before the encryption process begins. The group then threatens to leak this stolen data on public forums or leak sites if the ransom demand is not met. This approach increases the pressure on organizations, as the threat of exposing proprietary or personal information can cause significant reputational and legal damage.

Details of the alleged infiltration

The CRPxO group alleges that it successfully infiltrated the corporate network of Qube Aviation Catering. The threat actor claims to have gained unauthorized access to several critical business systems, including e-commerce servers, inventory management systems, and supplier databases. By targeting these specific areas, the attackers aim to maximize the impact of the breach by accessing both customer-facing and internal operational data.

The group has stated that the organization must enter into negotiations with them to prevent the public release of the allegedly stolen datasets. While the specific ransom demand has not been disclosed, the threat of publication remains the primary lever used by the group to pressure the organization.

Alleged data contents and affected information

The data allegedly stolen by CRPxO is extensive, covering various aspects of the company's operations and personnel. The group claims to have accessed a wide range of sensitive files, including corporate email archives and recipe databases. Furthermore, the breach reportedly includes critical operational information such as airport kitchen access credentials and B2B contracts.

The information allegedly compromised includes the following categories:

• Customer PII
• Payment information
• B2B contracts
• Employee HR records
• Financial records

Beyond these categories, the group specifically claims to have taken 492 customer records, which reportedly contain names, emails, phone numbers, and addresses. Additionally, the stolen data is said to include order histories, payment details, and employee-related documents such as payroll records and W-2 forms.

Organization profile and potential impact

Qube Aviation Catering is a company that provides food and catering services for the aviation industry. The company offers specialized catering solutions for flight operations, making it a key player in the transportation sector's supply chain.

This incident may expose Qube Aviation Catering employees and customers to significant risks, including the possibility of identity theft. Furthermore, the exposure of B2B contracts and airport access credentials could compromise the organization's supply chain security and potentially facilitate secondary attacks against the company or its partners. Given that the organization is based in the United States, the incident may lead to legal consequences under relevant state laws and federal data protection regulations.

For organizations operating in the transportation and aviation sectors, maintaining robust cybersecurity posture is essential. This includes implementing strict access controls, particularly for sensitive areas like airport kitchen facilities, and ensuring that supplier and customer databases are heavily protected. While information regarding the CRPxO group remains limited, such ransomware claims can negatively impact an organization's operational continuity and overall reputation.