RansomHub ransomware group lists www.emeryair.net on its leak site

• Ransomware group: RansomHub
• Country: United States
• Sector: Transportation
• Announcement date: February 26, 2025

RansomHub claims to have stolen data from Emery Air

The RansomHub ransomware group has listed a dataset on its leak site that they claim belongs to Emery Air. This announcement, posted on February 26, 2025, suggests a significant breach of the United States-based aviation services provider. The group claims the attack took place on February 13, 2025, and they have published various file samples to support their claims of having access to the company's internal information.

Ransomware leak sites are platforms used by cybercriminal groups to pressure victims into paying ransoms. These groups often employ a tactic known as double extortion, where they not only encrypt an organization's data to disrupt operations but also steal sensitive information to threaten its public release. By hosting stolen data on these sites, attackers aim to maximize the pressure on an organization to comply with ransom demands to prevent reputational and legal damage.

Details of the alleged data breach

According to the listing provided by RansomHub, the stolen dataset is substantial in size and volume. The group claims to have acquired approximately 121.5 GB of data, which is comprised of 155,914 files. The announcement includes various file samples that appear to contain internal operational documents, financial reports, and sensitive employee information.

The specific types of data mentioned in the listing include:

• Financial records
• Employee training data
• Operational documents
• Contact information

The content of these files reportedly includes internal operational manuals, invoice records, general ledger reports, and balance sheets. Furthermore, the leak allegedly contains employee training records and certification documents originating from the Office of the Illinois State Fire Marshal.

About Emery Air

Emery Air is an aviation services company based in the United States. The company provides various aviation solutions, including aircraft maintenance, repair, and ground handling services.

Risk assessment and implications

The exposure of the allegedly leaked data may pose secondary risks such as identity theft or targeted phishing attacks for Emery Air employees and business partners. The exposure of the company's financial records and operational documents could lead to the disclosure of trade secrets and potential damage to competitive advantage. As a US-based entity, the organization may face legal proceedings regarding data privacy violations under relevant state laws and federal regulations.

Given the RansomHub group's reported association with former ALPHV affiliates, it is assessed that the group may employ double-extortion tactics. This situation could create significant pressure on the institution's operational continuity. When organizations face such threats, common defensive steps include implementing robust multi-factor authentication, maintaining offline backups, and conducting regular security awareness training to mitigate the risk of phishing.

Impact on industry stakeholders

The potential leak of operational manuals and certification documents from regulatory bodies like the Office of the Illinois State Marshal highlights the sensitive nature of the aviation sector. For companies in the transportation and aviation services industry, maintaining the confidentiality of operational procedures is vital for safety and regulatory compliance. A breach of this nature can disrupt the trust between service providers, clients, and regulatory authorities.