Stormous claims data breach against Wizz Air

• Ransomware group: Stormous
• Country: Hungary
• Sector: Transportation
• Announcement date: May 2, 2025

Stormous claims Wizz Air data breach

The threat actor known as Stormous has made a public claim regarding a data leak involving the Hungarian airline Wizz Air. According to an announcement made on a leak site on May 2, 2025, the group alleges that the company's security systems were inadequate, allowing for a compromise of sensitive information. The group claims that the breach occurred on April 30, 2025, approximately one month prior to the public announcement.

Ransomware groups often utilize leak sites to announce successful intrusions, a tactic frequently associated with double extortion. In such scenarios, attackers not only encrypt an organization's internal systems but also exfiltrate sensitive data to use as leverage. By threatening to release this information publicly, the threat actors attempt to pressure the victim into paying a ransom to prevent the exposure of confidential records. This method shifts the focus from mere operational disruption to significant reputational and regulatory risk.

Details of the alleged incident

The claims made by Stormous suggest a significant failure in the target's defensive posture. The group asserts that the breach was made possible due to insufficient security measures within the organization's infrastructure. While the group has taken credit for the intrusion, it is important to note that the specific details regarding the method of entry or the exact timing of the exfiltration remain based solely on the group's allegations.

Regarding the specific information that has been targeted, the group claims that the leaked data belongs to employees of the airline. However, it is important to note that the provided screenshot associated with the claim does not display a direct file list that can be definitively linked to Wizz Air. Consequently, the exact scope and nature of the files remain unverified through the provided evidence.

Affected data types

• Employee data

About Wizz Air

Wizz Air is a Hungarian low-cost airline. It provides affordable flight services to numerous destinations across Europe.

Risk assessment and industry implications

The potential exposure of employee personal information carries significant risks, most notably the risk of identity theft for the individuals involved. When personal identifiers are leaked, they can be exploited by various malicious actors for fraudulent activities. Furthermore, because Wizz Air is based in Hungary, any confirmed data breach could trigger formal legal processes under the General Data Protection Regulation (GDPR) frameworks, which govern data privacy and protection within the European Union.

The Stormous group is recognized for conducting politically motivated actions, and they may utilize data leaks as a specific pressure tactic to achieve their objectives. This adds a layer of complexity to the incident, as the motivations may extend beyond simple financial gain. In situations where a company denies a breach that a threat actor claims has occurred, it can create a communication gap between the parties involved. Such a discrepancy can potentially increase the risk of secondary attacks, as the organization may be caught off guard by subsequent exploitation attempts.

For organizations operating within the transportation sector, maintaining robust cybersecurity defenses is critical. Common defensive steps to mitigate such risks include implementing multi-factor authentication, maintaining rigorous patch management schedules, and conducting regular security awareness training for employees. Additionally, continuous monitoring of network traffic and the implementation of zero-trust architectures can help detect and contain unauthorized access before significant data exfiltration can occur. As the threat landscape evolves, the ability to respond quickly and transparently to potential incidents remains a cornerstone of effective cybersecurity management.