Collins Aerospace / RTX.com Listed by everest Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Collins Aerospace, a major unit of RTX (formerly Raytheon Technologies), has been listed by the everest ransomware group as a victim of a data breach involving the exfiltration of internal files. The listing was reported on September 19, 2025. Public details remain limited: the number of people affected is unknown, and no further confirmation of the incident beyond the group's claim has been disclosed in available records.

This matters because Collins Aerospace supplies critical systems for commercial aviation and defense. Any compromise of internal files could affect operations, partners, and individuals whose data the company holds, even if the precise scale is unconfirmed.

What happened

According to the reported facts, Collins Aerospace was listed by the everest ransomware group in connection with a ransomware attack in which internal files were exfiltrated. The listing appeared under the headline referencing Collins Aerospace and RTX.com. The report date is September 19, 2025. No public information has been provided on the exact timing of the intrusion, the method of access, the volume of data taken, or whether systems were encrypted. The number of people affected is listed as unknown. The facts state only that internal files were exfiltrated; no additional technical details or company statements confirming or denying the claim are included in the available record.

Because the primary source is a ransomware group's leak-site listing, the incident should be treated as an unverified claim unless independently confirmed. No dollar amounts, file counts, or specific dates of compromise beyond the report date have been disclosed.

The group behind it: everest

Everest is a ransomware operation known for double-extortion tactics: operators gain access to networks, steal data, and then threaten to publish it on a dedicated leak site if a ransom is not paid. The group typically lists victims with sample files or descriptions of stolen material to pressure payment. Public reporting on everest has documented its activity against organizations in multiple sectors, including manufacturing, technology, and services, often using common initial-access methods such as compromised credentials or unpatched systems. The group claims responsibility for the Collins Aerospace listing; no independent verification of that specific claim is contained in the facts provided here.

Everest's model relies on the reputational and operational risk of data exposure rather than encryption alone. Victims are frequently named publicly before any negotiation concludes, which is the context in which the Collins Aerospace listing appeared.

Who is Collins Aerospace?

Collins Aerospace is a large aerospace and defense supplier formed in 2018 through the combination of UTC Aerospace Systems and Rockwell Collins. It operates as a unit of RTX (Raytheon Technologies Corporation) and develops avionics, cabin systems, aerostructures, mission systems, and related intelligent solutions for commercial airlines, business aviation, and military customers worldwide. Organizations of this type routinely hold engineering data, supplier contracts, employee records, customer technical information, and operational documentation that support aircraft manufacturing, maintenance, and defense programs.

A breach at such a firm is consequential because of its position in global supply chains. Disruptions or data exposure can affect airline safety systems, defense readiness, and the personal information of employees, contractors, and partners who interact with the company.

What was likely exposed

The facts name the exposed material only as "internal files exfiltrated in ransomware attack." No specific categories—such as employee personal data, customer records, source code, or financial documents—are detailed, and the number of people affected remains unknown. Exact contents are therefore unconfirmed.

Organizations in the aerospace and defense sector typically maintain a range of sensitive material: employee and contractor personally identifiable information, technical drawings and specifications, supplier and customer contracts, internal communications, and operational data. Any of these could theoretically be among internal files, but public records do not confirm what was taken in this case. Readers should treat claims of specific data types as unverified until official notifications or further disclosures appear.

Why it matters

For individuals, the primary risk is that personal or professional information held by Collins Aerospace—if present among the exfiltrated files—could be used for phishing, identity fraud, or targeted social engineering. Employees, former staff, contractors, and partners whose details appear in internal systems may face elevated exposure even when the precise data set is unknown. For the organization, the consequences include potential operational disruption, regulatory scrutiny under data-protection and defense-related rules, and damage to trust with airlines and government customers who rely on the integrity of its systems and data.

Because aerospace firms sit at the intersection of commercial aviation safety and national security supply chains, even limited internal-file exposure can create secondary risks for partners who share information with Collins Aerospace. The absence of confirmed numbers or data categories does not eliminate these concerns; it simply means the full scope remains unclear.

Were you affected?

If you are a current or former employee, contractor, supplier, or customer of Collins Aerospace or RTX, monitor official communications from the company for any breach notification. Watch for unusual account activity, unexpected password-reset emails, or phishing attempts that reference aerospace or defense topics. Consider placing fraud alerts with credit bureaus if you believe personal data may have been involved, and change passwords on any accounts that reused credentials associated with work email.

You can also run a free exposure scan of your email address to check whether it has already appeared in known breach data sets. This provides an early indicator but does not replace official company notices, which remain the authoritative source for this incident.

AICompiled with AI assistance from public sources and published under our editorial standards.