HIZE Aero Listed by ULose Ransomware Group: What Was Exposed & What To Do

People connected to HIZE Aero — employees, contractors, or partners — may be wondering whether internal company material that touches their work or identity has been taken. On 9 June 2026 the organisation was listed by the ransomware group ULose, which claims to hold a large volume of internal files. How many individuals are affected remains unknown, and public detail is limited, yet the listing alone is enough reason for anyone tied to the firm to understand what has been asserted and what practical steps follow.

The group’s own notice states that it possesses “all PDM Server’s data” of HIZEAERO, describes the company as a partner of Boeing, puts the volume at 1 TB, names the country as South Korea, and marks the status as private. Those claims have not been independently confirmed in the available record; they are the basis of the public listing and nothing more.

Inside the incident

According to the reported summary, ULose asserts that it exfiltrated internal files in a ransomware attack against HIZE Aero. The material is described specifically as data from the company’s PDM (Product Data Management) servers, totalling roughly 1 TB. The listing was reported on 9 June 2026. No public figure has been given for the number of people whose information may be involved, and the precise method of initial access, the duration of any intrusion, and whether systems were encrypted or merely copied have not been disclosed in the facts at hand.

What is known is therefore narrow: a ransomware group has placed HIZE Aero on its leak site, claims possession of a terabyte-scale set of PDM-server data, and characterises the company as a South Korean aerospace firm linked to Boeing. Everything beyond that claim remains unconfirmed.

Who is ULose?

ULose is a ransomware operation that follows the now-familiar double-extortion pattern used by many contemporary groups. After gaining access to a network, such actors typically exfiltrate data and then threaten to publish it unless a payment is made; the leak-site listing itself is the public pressure mechanism. Groups of this type often advertise stolen volumes, name high-profile partners or customers of the victim, and keep listings marked “private” until negotiations conclude or fail. Prior public activity by ULose has followed that template, though no verified statement from the group beyond the HIZE Aero listing itself is part of the present record.

Because leak-site posts are controlled by the attackers, they must be treated as claims rather than established fact. The assertion that “all PDM Server’s data” was taken, the 1 TB figure, and the Boeing partnership reference originate with ULose and have not been corroborated here.

HIZE Aero and its sector

HIZE Aero is identified in the listing as a South Korean company operating in the aerospace field and described by the attackers as a partner of Boeing. Organisations in this sector design, manufacture or supply components and systems for commercial and defence aviation. Their internal systems commonly hold engineering drawings, bills of materials, configuration data, supplier information and project documentation — precisely the kind of material managed by Product Data Management platforms.

A breach affecting an aerospace supplier is consequential because the data can touch regulated programmes, intellectual property shared under strict contractual controls, and the identities of staff and partners who work on sensitive projects. Even when personal data volumes are unknown, the industrial and supply-chain context raises the stakes for both the company and anyone whose details appear inside those systems.

The information in question

The only data type named in the available facts is “internal files exfiltrated in [a] ransomware attack,” further specified by the group as the contents of HIZE Aero’s PDM servers. No inventory of file names, no confirmation of employee or customer personal data, and no breakdown of structured versus unstructured records have been published. The 1 TB figure is the attackers’ claim alone.

Companies of this kind typically store engineering models, revision histories, part specifications, supplier contracts, access logs and, in many cases, directories or contact records of staff and partners. Whether any of those categories were actually present in the taken material is unconfirmed. Readers should therefore treat the exposure as a claim of internal corporate files whose exact personal or technical contents remain undisclosed.

What's at stake

For individuals, the concrete risks depend on what the files actually contain. If personnel records, email addresses, national identification numbers or authentication material were among the PDM data, those people could face phishing, identity misuse or credential stuffing. If only pure engineering artefacts were taken, the direct personal risk is lower, yet contractors or employees named inside project files could still be targeted with tailored social-engineering messages that reference real programmes.

For HIZE Aero the stakes include potential loss of intellectual property, contractual obligations to customers such as the Boeing partnership claimed by the attackers, regulatory notification duties under South Korean and international rules, and the operational cost of investigating and containing the incident. Because the number of affected people is unknown and the precise contents unverified, both the human and organisational impact remain partly opaque; that uncertainty itself is a source of ongoing risk until fuller disclosure occurs.

If your data was in this breach

If you work for, contract with, or otherwise share information with HIZE Aero, treat the listing as a prompt to act rather than proof that your personal data is already public. Change passwords on any accounts that reuse credentials tied to work email, enable multi-factor authentication wherever it is available, and watch for unexpected messages that reference aerospace projects or internal file names. Monitor financial and credit activity if you have reason to believe identity documents were stored on company systems. Keep records of any suspicious contact.

You can also run a free exposure scan of your email address to check whether that address has already appeared in known breach data sets. That step will not confirm or deny involvement in this specific incident, but it will tell you whether your email is circulating in other documented leaks and help you prioritise further protections.

AICompiled with AI assistance from public sources and published under our editorial standards.