Slug slimes aerospace biz AerCap with ransomware, brags about 1TB theft – Source: go.theregister.com

AerCap, the world’s largest aircraft leasing company, has reported a ransomware infection that occurred earlier this month, but claims it hasn’t yet suffered any financial losses yet and all its systems are under control.

In a US Securities and Exchange Commission (SEC) filing on Monday, the aerospace giant said it had “experienced a cybersecurity incident related to ransomware” on January 17, the report explained:

A ransomware crew called Slug has claimed responsibility for the intrusion and listed AerCap as its first public target. According cyberattack analysts at Hackmanac, the criminals claim to have stolen 1TB of data belonging to AerCap.

“As of now, Slug’s dark web portal remains bare, revealing no further information about the group,” the security firm Xeeted.

AerCap did not respond to The Register‘s inquiries. The biz is headquartered in Dublin, and its biggest customer is American Airlines. 

• Be honest. Would you pay off a ransomware crew?
• Fidelity National now says 1.3M customers had data stolen by cyber-crooks
• Subway’s data torpedoed by LockBit, ransomware gang claims
• Russians invade Microsoft exec mail while China jabs at VMware vCenter Server

Also on Monday, LoanDepot updated its Form 8-K filing with the SEC, and now says says crooks stole personal information belonging to millions of people in a ransomware attack earlier this month.

“Although its investigation is ongoing, the company has determined that an unauthorized third party gained access to sensitive personal information of approximately 16.6 million individuals in its systems,” the mortgage lender noted.

LoanDepot said it has hired outside forensics and security experts to investigate the incident, and has made “significant progress in restoring our loan origination and loan servicing systems, including our MyloanDepot and Servicing customer portals.”

LoanDepot disclosed the “cyber incident” in a January 8 SEC filing, noting the it took some IT systems offline due to the intrusion. And while it didn’t call the attack ransomware directly, it did say that the incident included “encryption of data.” ®