HI FLY Listed by hive Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

People whose information may be held by HI FLY have reason to consider whether internal records containing personal or operational details have been copied without authorization. On 18 December 2021 the organization appeared on a leak site associated with the hive ransomware group, which stated that internal files had been taken during a ransomware incident. The number of individuals affected remains unknown, and no further confirmation of the data’s contents or subsequent distribution has been made public.

Breaking down the breach

The only confirmed public detail is the listing itself. HI FLY was added to the hive ransomware group’s leak site on 18 December 2021. The group claims to have exfiltrated internal files during a ransomware attack. No figure for the volume of data, the number of records, or the date of the intrusion has been released. It is not known whether any ransom demand was issued or met.

Inside hive

Hive is a ransomware operation that first appeared in 2021 and has been observed using a double-extortion model: encrypting systems and also copying data before deployment of ransomware. When organizations decline to pay, the group has listed them on a publicly accessible leak site and, in some cases, released sample files. The group’s infrastructure has been disrupted by law-enforcement actions since 2022, but earlier listings, including the one naming HI FLY, remain part of the historical record of its activity.

About HI FLY

HI FLY operates in the commercial aviation sector, providing aircraft leasing and charter services. Organizations of this type routinely maintain records relating to passengers, crew, maintenance, and commercial contracts. A compromise of such records can therefore touch both personal identifiers and sensitive operational information.

What data was at risk

The listing refers only to “internal files.” No inventory of specific data categories has been published. Aviation companies commonly hold passenger names, contact details, travel itineraries, payment references, employee records, and technical documentation. Whether any of these categories were among the exfiltrated material is unconfirmed.

Why it matters

Internal files from an aviation operator can contain information that, if exposed, may be used for targeted fraud, social-engineering attempts, or further criminal activity. For the organization, the incident adds to the operational and regulatory burden of investigating unauthorized access and notifying affected parties where required. Because the scale and exact contents remain undisclosed, the practical consequences for individuals cannot be quantified from public sources.

What to do if you're exposed

Individuals who believe their information may have been held by HI FLY can take the following steps:

• Monitor bank and credit-card statements for unauthorized activity.
• Enable multi-factor authentication on any accounts that may be linked to travel or loyalty programs.
• Request a copy of personal data held by the organization under applicable data-protection rules.
• Run a free exposure scan of their email address against known breach data sets to check for prior appearances.

AICompiled with AI assistance from public sources and published under our editorial standards.