{"id":117738,"date":"2025-10-19T03:00:00","date_gmt":"2025-10-18T21:30:00","guid":{"rendered":"https:\/\/aviationa2z.com\/?p=117738"},"modified":"2025-10-19T02:18:16","modified_gmt":"2025-10-18T20:48:16","slug":"american-airlines-largest-regional-subsidiary-suffers-data-breach","status":"publish","type":"post","link":"https:\/\/aviationa2z.com\/index.php\/2025\/10\/19\/american-airlines-largest-regional-subsidiary-suffers-data-breach\/","title":{"rendered":"American Airlines’ Largest Regional Subsidiary Suffers Data Breach"},"content":{"rendered":"\n

IRVING-<\/strong> Envoy Air (MQ)<\/a>, American Airlines’ largest regional subsidiary, has confirmed a cybersecurity incident involving its Oracle E-Business Suite data after the Clop ransomware group listed American Airlines on its leak site.<\/p>\n\n\n\n

The airline stated that while some business and commercial contact data may have been accessed, no sensitive customer or financial information was compromised. The breach, linked to a broader Oracle E-Business Suite zero-day campaign, is part of an ongoing cyber threat targeting multiple organizations worldwide.<\/p>\n\n\n\n

\"American
Photo: By Aaron Davis – Gallery page http:\/\/www.instagram.com\/threshold.productions, CC BY-SA 4.0, https:\/\/commons.wikimedia.org\/w\/index.php?curid=92713161<\/figcaption><\/figure>\n\n\n\n

Envoy Air Confirms Data Breach<\/h2>\n\n\n\n

Envoy Air, operating regional flights under the American Eagle<\/a> brand, confirmed that its Oracle E-Business Suite application was affected by a data breach incident traced to the Clop extortion group.<\/p>\n\n\n\n

Following the discovery, the airline initiated an investigation, engaged law enforcement, and verified that no personal passenger data was impacted.<\/p>\n\n\n\n

The Clop group began leaking stolen data allegedly belonging to Envoy on its dark web platform, accusing the airline of neglecting cybersecurity concerns.<\/p>\n\n\n\n

This attack is part of a broader campaign exploiting vulnerabilities within Oracle systems, specifically a zero-day flaw tracked as CVE-2025-61882, which Oracle later confirmed had been used in active attacks before being patched.<\/p>\n\n\n\n

CrowdStrike and Mandiant cybersecurity researchers reported that Clop exploited these vulnerabilities in early August 2025 to deploy malware and steal information from multiple organizations.<\/p>\n\n\n\n

While the exact number of victims remains unknown, industry experts suggest dozens of companies have been affected globally.<\/p>\n\n\n\n

\"American
Photo: By Halligan218 – Own work, CC BY-SA 4.0, https:\/\/commons.wikimedia.org\/w\/index.php?curid=114029130<\/figcaption><\/figure>\n\n\n\n

American Airlines Cyber Threats<\/h2>\n\n\n\n

Envoy Air, though operating independently, remains closely integrated into American Airlines\u2019<\/a> operational ecosystem for scheduling, ticketing, and customer management. This integration heightens potential cybersecurity exposure across shared systems.<\/p>\n\n\n\n

American Airlines, headquartered in Dallas\u2013Fort Worth International Airport (DFW), previously experienced breaches in 2022 and 2023, which exposed employee data.<\/p>\n\n\n\n

The latest incident adds to growing concerns about airline industry vulnerabilities, particularly those connected to third-party enterprise applications.<\/p>\n\n\n\n

\"\"
Aircraft Involved in the DC Crash; Photo- Wikipedia <\/figcaption><\/figure>\n\n\n\n

Clop\u2019s Expanding Cyber Campaign<\/h2>\n\n\n\n

The Clop ransomware group, also tracked as TA505, Cl0p, and FIN11, has a history of exploiting critical vulnerabilities to exfiltrate corporate data.<\/p>\n\n\n\n

Since its emergence in 2019, Clop has evolved from deploying ransomware to large-scale data breach operations leveraging zero-day exploits.<\/p>\n\n\n\n

Major attacks attributed to Clop include:<\/p>\n\n\n\n