Loading story…
The Everest ransomware group claimed responsibility for a significant cyberattack on Dublin Airport, exfiltrating the personal data of over 1.5 million passengers. The stolen information includes full names, flight details, frequent flyer information, baggage tag numbers, and other sensitive travel data. The group listed Dublin Airport as a victim on its leak site, password-protecting the data and demanding negotiations within six days to prevent public release. Irish authorities and the National Cyber Security Centre have launched investigations, while Dublin Airport faces the challenge of rebuilding its affected servers from scratch.
The attack highlights critical vulnerabilities in aviation infrastructure, particularly the reliance on centralized software platforms such as Collins Aerospace’s MUSE system. The incident has caused operational disruptions, forcing manual fallback procedures and resulting in significant delays and inconvenience for passengers. The Everest campaign underscores the urgent need for enhanced cybersecurity resilience across the aviation sector, as the breach not only threatens data privacy but also exposes the operational fragility of major airports.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
Everest said the stolen Dublin Airport passenger data was being held in password-protected form as part of a double-extortion scheme and gave the airport six days to respond before public release. The demand was later reported as a $1 million payment tied to the data.
Irish authorities and the National Cyber Security Centre were reported to be investigating the claimed breach affecting Dublin Airport. The airport was also said to be rebuilding servers from scratch, with no recovery timeline disclosed.
Reporting on the incident tied the Dublin Airport compromise to broader disruption affecting the aviation sector following issues involving Collins Aerospace systems, which had forced some European airports into manual operations. This framed the airport breach as part of a larger operational and cybersecurity impact chain.
On its leak site, the Everest ransomware group claimed it had breached Dublin Airport and stolen 1,533,900 passenger records. The group said the data included names, flight details, frequent-flyer information, travel status indicators, and baggage tag data.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
6 references tracked. Mallory keeps watching after this page renders.
hackread.com
Open sourcethecyberthrone.in
Open sourcebankinfosecurity.com
Open sourcegovinfosecurity.com
Open sourcescworld.com
Open sourcehackread.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The Everest ransomware group has claimed responsibility for significant cyberattacks against Iberia, Spain's national airline, and Air Miles España, the operator of the Travel Club rewards program. In these incidents, Everest reportedly exfiltrated 596 GB of sensitive data from Iberia, including personal and payment information, loyalty details, travel histories, and booking-related communications for millions of customers across multiple countries. The attackers also claim to have had the ability to manipulate bookings, such as changing contact details, modifying seats, and cancelling tickets, posing a severe risk to passenger data security and operational integrity. For Air Miles España, Everest claims to have stolen approximately 131 GB of data and locked internal systems, following a double extortion model where files are both stolen and systems encrypted to pressure for ransom payment. The breaches have raised significant concerns about identity theft, phishing, and regulatory compliance, particularly under GDPR, given the scale and sensitivity of the compromised data. The Everest group has threatened to leak the stolen information if negotiations with the affected organizations fail, a tactic consistent with their previous operations. The attacks highlight a growing trend of ransomware groups targeting high-profile entities in the travel and rewards sectors, with potential impacts extending to millions of individuals and business partners in Spain, Latin America, and other regions where Iberia and Travel Club operate.
Jun 29, 2026
A ransomware attack targeting Collins Aerospace's passenger processing software caused widespread disruptions at major European airports, including London Heathrow, Berlin Brandenburg, and Brussels. The attack, which began on September 19, affected the ARINC SelfServ cMUSE and MUSE systems used for check-in and baggage handling, forcing airports to switch to manual processes and resulting in hundreds of flight cancellations and extensive delays. The UK's National Crime Agency arrested a man in West Sussex on suspicion of Computer Misuse Act offences in connection with the incident, though the investigation remains ongoing. RTX Corporation, the parent company of Collins Aerospace, confirmed the attack and stated that the affected systems operate on customer-specific networks outside the main RTX enterprise network. The incident highlights the significant operational impact ransomware can have on critical aviation infrastructure.
Jun 29, 2026
The Everest ransomware operation claimed it stole data tied to **Citizens Financial Group** and **Frost Bank** and threatened to publish the information after listing both institutions on its leak site. Reports said Everest alleged it held nearly **3.4 million** Citizens-related records from a SQL database dump and about **250,000** Frost customer records, with sample data purportedly including personal and financial information. The gang gave the organizations a short deadline before release and framed the incident as part of its broader double-extortion campaign. Both banks said their own internal networks were not directly compromised and attributed the exposure to a **third-party vendor**. Citizens said the material involved mostly **masked test data** with only limited real customer information, while Frost said it had brought in external cybersecurity experts to investigate. The activity was linked to Everest, a Russia-linked ransomware-as-a-service group that has previously targeted major enterprises including Nissan, Collins Aerospace, Iberia Airlines, Under Armour, and BMW.
Jun 29, 2026