Mettis Aerospace Listed by blackbasta Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On 8 March 2023, the ransomware group known as blackbasta listed Mettis Aerospace on its leak site, claiming the company had been hit in a ransomware attack that involved the exfiltration of internal files. The number of people affected remains unknown, and public detail beyond the listing itself is limited.

The claim places a UK manufacturer of precision aerospace components in the frame of a double-extortion incident. What has been confirmed so far is only the group's assertion and the reported nature of the data involved; independent verification of the full scope has not been made public.

Inside the incident

According to the available record, Mettis Aerospace was listed by blackbasta on 8 March 2023. The group asserted that internal files had been exfiltrated as part of a ransomware attack. No public figure has been given for the volume of data taken, the duration of any network access, or the precise method of initial intrusion. The number of individuals whose information may have been involved is recorded as unknown.

Ransomware operations of this type typically combine encryption of systems with the theft of data, followed by a threat to publish the material if demands are not met. In this case, the sole concrete public marker is the leak-site listing itself. Whether negotiations occurred, whether any ransom was paid, or whether files were subsequently released in full has not been disclosed in the material available for this account.

Who is blackbasta?

Blackbasta is a ransomware operation that became publicly active in 2022. Like other groups in the same category, it has generally followed a double-extortion model: encrypting victim systems while also copying data and threatening to leak it. The group has been observed targeting organisations across multiple sectors and geographies, often after gaining access through compromised credentials, exploited vulnerabilities, or other common initial-access routes.

Listings on blackbasta's leak site constitute claims by the group. They are not independent confirmations of every detail asserted. In the present matter, the record states only that Mettis Aerospace was listed and that internal files were described as having been exfiltrated; no further specific statements attributed to the group about this victim appear in the facts at hand.

Who is Mettis Aerospace?

Mettis Aerospace designs, manufactures and assembles precision forged and machined components at an integrated facility in the United Kingdom. The company positions itself as a supplier of high-quality parts for current and next-generation programmes, with vertically integrated centres of competence focused on forging, machining and related processes. Its work sits inside the aerospace supply chain, a sector in which quality, traceability and controlled information are central to day-to-day operations.

Organisations of this kind typically hold engineering drawings, process specifications, supplier and customer records, employee data, and commercial documentation. A breach affecting such a firm can therefore touch both operational continuity and the confidentiality of material that partners and staff expect to remain protected. The consequential nature of an incident here stems from that combination of specialised manufacturing knowledge and the ordinary administrative data any established employer maintains.

What data was at risk

The facts name the exposed material as internal files exfiltrated in a ransomware attack. No fuller inventory—such as specific categories of personal data, exact file counts, or named document types—has been disclosed publicly. It is therefore not possible to state with certainty which records were taken.

Companies in precision aerospace manufacturing commonly retain design and production data, quality-assurance records, contractual files, and human-resources information. Any of those classes could in principle have been among internal files, yet the exact contents remain unconfirmed. Readers should treat claims of precise data types beyond the stated “internal files” as unverified unless further official detail emerges.

Why it matters

For individuals, the practical risk depends on whether personal or contact information was among the internal files. If so, possible consequences include unwanted contact, phishing that references genuine employment or supplier relationships, or attempts to misuse identity details. Because the scale and composition of the data are unknown, the degree of personal exposure cannot be quantified from public sources alone.

For the organisation, a ransomware incident that includes exfiltration can disrupt production systems, strain customer and supplier confidence, and create ongoing obligations around notification and remediation. In a sector that supplies critical components, even temporary interruption or the mere appearance of compromised internal material can carry commercial and reputational weight. None of these outcomes is asserted here as proven fact for this specific case; they are the ordinary stakes when internal files are claimed to have left a manufacturing environment under duress.

If your data was in this claimed breach

If you believe you may have been affected—whether as an employee, contractor, customer contact or supplier—consider the following measured steps:

• Monitor financial and email accounts for unexpected activity or messages that reference Mettis Aerospace or related programmes.
• Treat unsolicited requests for credentials, payments or further personal details with caution, especially if they appear to draw on insider knowledge.
• Change passwords on any accounts that reused credentials associated with work or supplier portals, and enable multi-factor authentication where available.
• Request clarification from the company through official channels if you have a direct relationship and need to know whether your information was involved.
• Run a free exposure scan of your email address to check whether it has already appeared in known breach datasets.

Public detail on this incident remains limited to the March 2023 listing and the description of exfiltrated internal files. Further clarity, if it comes, will most usefully come from official statements rather than from unverified secondary claims.

AICompiled with AI assistance from public sources and published under our editorial standards.