Pacific Airlines Listed by coinbasecartel Ransomware Group: Ransomware Claim — What’s Alleged & What To Do
Pacific Airlines was listed by the coinbasecartel ransomware group on January 29, 2026, after internal files were exfiltrated in an attack whose timing has not been established. Anyone who may have interacted with the airline should review their accounts and monitor for suspicious activity.
What happened
The incident came to light through a listing posted by coinbasecartel on January 29, 2026. The group claims to have obtained internal files from Pacific Airlines during a ransomware operation. No further details on the timing of the intrusion, the volume of data taken, or the method of access have been made public.
The group behind it: coinbasecartel
Coinbasecartel is a ransomware operator that maintains a leak site where it lists organizations it claims to have targeted. The group typically exfiltrates data before encrypting systems and then uses the threat of publication to pressure victims. Its listing of Pacific Airlines constitutes an unverified claim by the group; no independent confirmation of the data theft has been reported.
Pacific Airlines and its sector
Pacific Airlines is a low-cost carrier based in Ho Chi Minh City, Vietnam, and operates primarily from Tan Son Nhat International Airport. It was previously known as Jetstar Pacific between 2008 and 2020. Airlines routinely hold passenger records, booking details, payment information, employee data, and operational files required for flight scheduling and regulatory compliance.
What was likely exposed
The only data type identified in the listing is internal files exfiltrated during the ransomware attack. The precise contents of those files have not been disclosed. Organizations in this sector commonly store passenger names, contact details, travel itineraries, and limited financial data, but it is not confirmed whether any of these categories were among the materials taken.
The real-world impact
Exposure of internal airline files can create risks of identity misuse or targeted fraud for individuals whose records appear in the data. For the organization, the incident may lead to regulatory scrutiny under Vietnam’s data-protection rules and added costs for investigation and system restoration. The scale of these effects cannot be assessed until more information is released.
What to do if you're exposed
Monitor bank and credit-card statements for unusual activity and consider placing a fraud alert with credit agencies if personal financial details may be involved. Use a unique password for airline accounts and enable multi-factor authentication where available. Readers can run a free exposure scan of their email address against known breach data to check for appearances in public listings.
AICompiled with AI assistance from public sources and published under our editorial standards.
How this breach connects
More recent breaches
Correios Listed by coinbasecartel Ransomware GroupCambridge Mobile Telematics Listed by coinbasecartel Ransomware GroupDemand.io Listed by coinbasecartel Ransomware GroupCambridge Mobile TelematicNEW Listed by coinbasecartel Ransomware GroupLatest breaches
Publicly posted by coinbasecartel — unverified claim, pending independent verification
Breach listings — particularly those originating from ransomware or leak sites — are third-party claims that may be unverified, incomplete, or inaccurate. A listing does not by itself confirm that a breach occurred or that any specific data was exposed. Severity is an automated assessment, not a definitive rating. Verification status is shown where available.
Attributions to threat groups and methods reflect public reporting and, in some cases, unverified claims made by the groups themselves; they may be incomplete or later revised. Recent Breaches and GalaxyWarden are independent and are not affiliated with, and do not endorse, any company or group named on this page. This information is aggregated from public sources for awareness only and is not legal, security, or investment advice.