BianLian ransomware group claims it stole 210GB of data from Air Canada's systems

The infamous BianLian ransomware group has claimed responsibility for a cyber attack on Air Canada, stating that it is in possession of more than 200 gigabytes of information stolen from the airline.

Air Canada, the country’s largest airline, said in October that it suffered a data breach that compromised limited employee records.

In a statement on its website, Air Canada said, “An unauthorised group briefly obtained limited access to an internal Air Canada system related to limited personal information of some employees and certain records. We can confirm that our flight operations systems and customer-facing systems were not affected.”

The airline assured customers that none of their information had been accessed, but notified the affected parties and informed relevant authorities about the incident. Air Canada also affirmed that all of its systems were functioning normally. Following the breach, the company collaborated with cybersecurity experts to bolster the security of its systems.

Recently, the notorious BianLian ransomware group claimed responsibility for the data security incident at Air Canada, stating that it is in possession of 210 GB of data stolen from the airline’s internal database.

According to Brett Callow, a threat analyst at Emsisoft, the ransomware group also shared screenshots of data allegedly stolen from the airline and a detailed description of what was stolen from Air Canada’s internal network on its data leak site.

As stated in the post, the BianLian ransomware group claims to be in possession of technical and operational data from 2008 to 2023, data on company’s technical and security challenges, SQL backups, sensitive personal data of the airline’s employees, information on vendors and suppliers, confidential documents, and archives from company databases.

“Employee personal data is only a small fraction of the valuable data over which they have lost control. For example, we have SQL databases with company technical and security issues. You can check it out for yourself, a demo package with screenshots is available below. Backups with this data are available on our website and at your request,” the post reads.

Air Canada is yet to share details on when and how the threat actors infiltrated its network or the number of affected employees. An Air Canada spokesperson said, “BianLian had threatened to resort to exploiting the media in their unsuccessful extortion efforts.

“For this reason, we cannot comment on any claims made by an anonymous group based on cybercrime and we will not add anything to what we have said publicly. We trust that the media will consider this and report on issues such as this responsibly,” they added.