Air Arabia Listed by everest Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

People who have flown with Air Arabia, worked for the airline, or dealt with its subsidiaries may now face questions about whether their personal or business information has been exposed. On 25 October 2025 the airline was listed by the everest ransomware group, which claims to have taken internal files. The number of people affected remains unknown, and public detail on exactly what was taken is limited. For passengers, staff and partners, the practical stakes centre on the possibility that contact details, travel records or internal documents could surface and be misused.

This article sets out only what has been reported, places the claim in context, and outlines the concrete steps people can take while fuller information is still unavailable.

Breaking down the breach

According to the available record, Air Arabia was listed by the everest ransomware group on 25 October 2025. The listing states that internal files were exfiltrated in a ransomware attack. No figure has been given for the number of people affected, no specific file names or volumes have been published in the public summary, and the precise method of initial access has not been disclosed. The report characterises the incident simply as a ransomware attack involving the theft of internal files. Beyond the date of the listing and the claim of exfiltration, further technical or operational detail remains unconfirmed.

Because the only public marker is the group’s own listing, the incident should be treated as an unverified claim until Air Arabia or independent investigators provide additional confirmation. No dollar amounts, ransom demands or timelines of encryption versus data theft have been included in the facts released so far.

The group behind it: everest

Everest is a ransomware operation that has been active for several years and is known for a double-extortion model: encrypting systems while also stealing data and threatening to publish it on a dedicated leak site if payment is not made. The group typically recruits affiliates, provides them with ransomware tooling, and takes a share of any ransom. Victims are routinely named on the leak site with sample files or descriptions of the data allegedly taken; the listing itself is therefore a claim by the group rather than independent verification.

Public reporting on earlier everest campaigns shows a pattern of targeting mid-sized and larger organisations across multiple sectors, often after initial access through compromised credentials, phishing or unpatched remote services. The group has previously listed airlines, logistics firms and other travel-related entities, though each listing must be assessed on its own evidence. In the present case the only assertion that can be attributed to everest is that Air Arabia’s internal files were exfiltrated; no further statements by the group about this specific victim appear in the available facts.

Air Arabia and its sector

Air Arabia is a low-cost airline founded in 2003 and headquartered in Sharjah, United Arab Emirates. It operates flights to more than 170 destinations across the Middle East, North Africa, Asia and Europe, using a fleet of Airbus A320 aircraft. The company was the first publicly listed airline in the Middle East and has expanded beyond pure passenger transport into travel management, tourism and hospitality through various subsidiaries. Like other carriers, it necessarily processes large volumes of passenger booking data, crew and employee records, supplier contracts and operational documents.

Airlines sit at the intersection of personal travel information, payment systems and critical operational technology. A breach claim against any carrier therefore raises concerns not only for individual privacy but also for the integrity of schedules, loyalty programmes and partner relationships. Because Air Arabia serves a broad international network, any confirmed exposure could affect travellers and staff across multiple jurisdictions.

What data was at risk

The facts state only that “internal files” were exfiltrated. No further breakdown—customer databases, employee records, financial documents or operational manuals—has been disclosed. Organisations of this type typically hold passenger names, contact details, passport or identity numbers, booking histories, payment-card tokens, crew rosters, supplier contracts and internal correspondence. Whether any of those categories were among the files claimed by everest remains unconfirmed.

Until the airline or forensic investigators publish a verified inventory, the precise contents of the stolen material cannot be stated as fact. Readers should therefore treat any circulating lists or samples as unverified unless they are independently authenticated.

The real-world impact

For individuals, the main risks associated with airline-related data are identity fraud, phishing that references real flight details, and the possible sale of contact or travel information on criminal markets. Even if only internal administrative files were taken, those documents can still contain staff personal data or commercially sensitive material that could be used for social-engineering attacks against employees or partners. Because the number of people affected is unknown, the scale of any such risk cannot yet be quantified.

For Air Arabia the consequences include potential regulatory scrutiny under data-protection regimes in the jurisdictions it serves, reputational damage, and the operational cost of investigation and remediation. Ransomware incidents also frequently disrupt booking systems or internal communications, although no such disruption has been confirmed in the present record. The absence of a published count of affected individuals leaves both the company and its customers without a clear picture of exposure.

Were you affected?

If you have booked flights with Air Arabia, worked for the airline or its subsidiaries, or exchanged documents with the company, treat the listing as a reason for caution rather than confirmed compromise. Monitor bank and loyalty-programme statements for unexpected activity, be sceptical of unsolicited messages that reference recent travel, and enable multi-factor authentication on email and travel accounts. Change passwords that may have been reused across services. Because the exact data types remain undisclosed, these steps are precautionary.

Readers can also run a free exposure scan of their email address against known breach data sets to see whether their information has already appeared in other incidents. That check does not confirm or rule out involvement in this specific claim, but it provides an immediate, practical indicator of wider exposure and helps prioritise further protective measures while official details continue to emerge.

AICompiled with AI assistance from public sources and published under our editorial standards.