MJets Listed by incransom Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

People whose personal or financial details sit inside a private aviation company's systems have a practical reason to pay attention when that company appears on a ransomware group's leak site. Even when the exact number of individuals involved remains unconfirmed, the possibility that names, contact details or financial records have left the organisation's control creates lasting risks of fraud, phishing and unwanted exposure. Public reporting places MJets on the incransom listing as of 4 July 2025; what follows is limited to what has been stated and what is already known about the sector and the actor.

The listing itself is a claim by the group, not an independently verified confirmation of every detail. Still, for anyone who has flown with, worked for or done business with MJets, the appearance of the company name is enough reason to understand the incident and take basic protective steps.

Inside the incident

According to public reporting dated 4 July 2025, the ransomware group incransom listed MJets on its leak site. The group claims that internal files were exfiltrated in a ransomware attack and that a database containing personal data of more than 1,500 people, financial information and other internal files belonging to MJets is among the material taken. The number of people actually affected remains listed as unknown in available records. No further public detail has been provided on the precise date the intrusion began, the initial access method, the encryption status of systems, or whether any ransom demand was paid. The facts available stop at the listing and the group's description of the material it says it holds.

Because the scale and technical path of the attack have not been independently detailed, it is not possible to state how long the group may have had access or which specific systems were involved. What is known is limited to the claim that internal files were removed and that the group has publicly associated MJets with the incident.

Who is incransom?

incransom is a ransomware operation that follows the now-common double-extortion model: encrypting systems while also copying data and threatening to publish it if payment is not made. Groups of this type typically maintain dedicated leak sites where they post victim names, sample files and countdown timers. They often target mid-sized organisations across multiple sectors, using phishing, compromised credentials or unpatched remote-access services as entry points. Once inside, they move laterally, identify valuable data, exfiltrate it and then deploy ransomware. Public listings are used both as pressure on the victim and as advertising to other potential targets. No specific statements by incransom about MJets beyond the listing and the claimed contents of the database have been recorded in the available facts; any further claims would need separate verification.

About MJets

MJets is a private aviation company founded in 2007 through a partnership between William E. Heinicke, an aviation enthusiast, and Kirith Shah, a Thai businessman. By 2010 the company had established itself as a pioneer in fixed-base operations (FBO) in Thailand. FBOs provide ground handling, fuel, hangar space, passenger lounges and related services for private and business aircraft. Organisations of this kind routinely hold passenger and crew manifests, contact and identity details for clients and staff, flight schedules, billing and payment records, and internal operational documents. Because private aviation often serves high-net-worth individuals and corporate travellers, the data such a company holds can be especially sensitive. A breach at an FBO therefore carries consequences both for the individuals whose information is stored and for the company's ability to maintain client trust and regulatory standing.

What data was at risk

The available facts state that internal files were exfiltrated in a ransomware attack. The group's own description, as reported, claims the material includes personal data of more than 1,500 people, financial information and other internal files belonging to MJets. Exact file names, field-level contents and confirmation that every claimed record is authentic have not been independently published. Organisations operating fixed-base services typically retain passenger and crew personal details, contact information, passport or identity documents for international flights, payment card or bank details for billing, employee records and operational documents. Whether any or all of those categories were present in the claimed database remains unconfirmed beyond the group's statement. Readers should treat the 1,500-person figure and the presence of financial data as claims rather than verified inventory.

What's at stake

For individuals, the concrete risks include targeted phishing that references real flights or invoices, identity fraud if identity documents were among the files, and financial fraud if payment details may have been exposed. Even limited personal data can be combined with other breaches to build convincing social-engineering attacks. For MJets the stakes include potential regulatory scrutiny under data-protection rules, loss of client confidence in a sector that depends on discretion, and the operational cost of investigating, notifying and remediating. Because the number of affected people is still recorded as unknown, the full scope of individual impact cannot yet be measured. The absence of confirmed counts does not remove the need for caution among anyone who has shared personal or financial information with the company.

If your data was in this claimed breach

If you have been a client, passenger, employee or supplier of MJets, treat the possibility of exposure seriously even while details remain limited. Change passwords for any accounts that may have reused credentials linked to the company, enable multi-factor authentication wherever available, and monitor bank and credit-card statements for unexpected activity. Be alert to emails or messages that reference private aviation services or claim to come from MJets; verify any such contact through a known official channel rather than replying directly. Consider placing fraud alerts with credit bureaus if financial data may have been involved. You can also run a free exposure scan of your email address to check whether your information has already appeared in known breach data sets. Keep records of any suspicious contact and report confirmed fraud to the relevant authorities. Public information about this incident may be updated as more facts become available; until then, the prudent course is to assume that personal and financial details associated with MJets could be in unauthorised hands and to act accordingly.

AICompiled with AI assistance from public sources and published under our editorial standards.