Everest ransomware gang claims Atlas Air breach, warns Boeing data at risk

The Everest ransomware cartel has claimed it stole 1.2 terabytes of data from Atlas Air, one of the world’s largest cargo airlines, and warned that sensitive Boeing aircraft information could be exposed in what appears to be a broader aerospace supply chain attack. Atlas Air denied that its systems were breached.

Atlas Air’s name surfaced on a dark web forum operated by the Everest group, which alleged it siphoned technical and operational data from the airline. The post referenced maintenance documents, repair reports and logistics records tied to Boeing aircraft, along with internal company materials.

Atlas Air, a major global cargo carrier and one of the largest operators of Boeing 747 aircraft, generated $4.5 billion in revenue in its last reported financial results before going private and employs more than 4,000 staff. In a statement, a company representative said there were no breaches to its systems. The airline did not address the screenshots of alleged data posted by the attackers.

A review of the dark web posting showed no downloadable data samples. Instead, the attackers shared screenshots purportedly depicting internal documents. The images appeared to include aircraft maintenance files, parts catalogs and what looked like internal operational software interfaces. One screenshot referenced Malaysia Airlines, an entity not directly linked to Atlas Air, raising questions about the context of the material shown.

Days after naming Atlas Air, Everest claimed it had also breached Tsunami Tsolutions, an American aerospace engineering support and information solutions provider. The group again posted screenshots rather than raw data files. The materials displayed were similar in nature, including aircraft maintenance documentation, parts listings and references to Atlas Air and United Airlines aircraft.

In its post about Tsunami Tsolutions, Everest specifically stated it had obtained confidential information related to Boeing aircraft. The inclusion of major industry names in ransomware disclosures is a tactic frequently used to intensify pressure during ransom negotiations.

The proximity of the two claims and the overlap in the types of documents displayed suggest the possibility of a linked supply chain incident. Atlas Air operates aircraft supplied by Boeing, while Tsunami Tsolutions provides engineering and materials support within the aerospace sector. A compromise affecting one entity could potentially expose shared or interconnected data environments.