RansomHub group claims major data theft at Mexican airports operator OMA

Mexican airports operator Grupo Aeroportuario del Centro Norte said it experienced a data security incident that forced it to take several systems offline and rely on backup systems.

 

In a recent press release, Grupo Aeroportuario del Centro Norte (commonly known as OMA), responsible for operating and managing 13 international airports in Mexico, said that it has identified a data security incident that involved unauthorised threat actors infiltrating its internal network.

 

The company says it has launched an investigation, with assistance from external cyber security experts, to determine the nature and scope of the incident.

 

“The OMA IT team, in collaboration with external cybersecurity experts, is actively investigating the incident to determine its scope and ensure the protection of the integrity, confidentiality and availability of our systems.

 

“Our operations are working through alternative and backup systems. To date, no adverse material effect has been presented in the operations, results or financial position of the company, which will be evaluated continuously until the situation has been completely resolved,” reads the press release.

 

Recently, the RansomHub ransomware group claimed responsibility for the cyber attack on OMA and listed it as a victim on its data leak site. The group claims to be in possession of 3 terabytes of data allegedly stolen from the company.

 

 

The stolen data includes investment reports, financial documents, sales and accounting data, shareholder information, personal information of investors, client lists, assessments, agreements, and personal data of employees and customers including their addresses, contacts, passport scans, confidential internal correspondence, passwords, credentials, and SQL databases.

 

The ransomware group also said that it has evidence of some employees collaborating with cartels. It has given OMA till November 3 to pay a ransom, failing which it has threatened to leak the stolen data.