Willis Lease Finance Corporation acknowledges cybersecurity incident after data breach

In a recent disclosure to US regulators, Willis Lease Finance Corporation admitted to falling victim to a "cybersecurity incident" after posting purportedly stolen data on the Black Basta ransomware group’s leak blog.

According to a form 8-K filed with the Securities and Exchange Commission (SEC) on February 9, the NASDAQ-listed company detected a potential breach on January 31, prompting immediate action to address the situation.

An investigation into the incident’s nature and extent was initiated with assistance from leading third-party cybersecurity experts. The company swiftly took steps to contain, assess, and remediate the activity, including temporarily taking certain systems offline.

Despite implementing workarounds to continue operations and serve customers during this period, Willis Lease Finance Corporation did not provide specific details regarding these measures. The company is actively working to ascertain the full scope of the breach and determine whether any data was compromised. Law enforcement has been notified of the incident.

While the disclosure refrains from explicitly mentioning "ransomware," data posted by Black Basta suggests the potential theft of sensitive information. The ransomware group claims to have accessed 910 GB of company data, including customer information, HR documents, non-disclosure agreements (NDAs), and more.

Samples of the stolen data posted online include screenshots of accessed file trees, HR documents containing social security numbers, leasing agreements with major airlines, and scans of identity documents such as passports.

Cross-referencing the names on these documents with online sources revealed matches primarily among US and UK staff, along with individuals from other countries. Despite attempts to reach the company’s communication team for comment, no response has been received.

With over 45 years of operation, Willis Lease Finance Corporation is recognized as one of the longest-standing independent sellers and lessors of jet engines to major airlines worldwide.