UAM Listed by datacarry Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

The incident involving Universal Asset Management, known as UAM, centers on a listing by the datacarry ransomware group on November 21, 2025. The group claims to have exfiltrated internal files during a ransomware attack, though the number of individuals affected remains unknown and no further confirmation of the data's release has been made public. For people connected to the aviation sector or UAM's operations, this raises questions about how records tied to aircraft leasing, trading, and end-of-life management might be handled if the files contain personal or operational details.

Breaking down the breach

The only confirmed detail is the reported date of November 21, 2025, when datacarry listed UAM on its site. The group states that internal files were taken during a ransomware incident, but no information has been released on the volume of data, the timing of the intrusion itself, or whether any material has been published beyond the initial claim. The scale of impact on individuals is listed as unknown.

Who is datacarry?

Datacarry is a ransomware operator that maintains a public leak site where it posts names of organizations it claims to have targeted. Such groups commonly encrypt systems to disrupt operations and then threaten to disclose stolen files unless a ransom is paid. Their listings represent assertions by the group rather than independently verified events, and the accuracy of any specific claim must be assessed against statements from the affected organization.

UAM and its sector

UAM, or Universal Asset Management, was established in 1992 and is headquartered in Tennessee. It provides aviation services focused on whole-asset management, including leasing, trading, and dismantling of commercial aircraft, with an emphasis on material recycling. Organizations in this sector routinely handle contracts, maintenance records, client information, and regulatory documentation across international operations.

What data was at risk

The listing refers to internal files taken in a ransomware attack. No further breakdown of file contents or data categories has been disclosed. Aviation asset-management firms typically maintain records that can include customer details, supplier information, aircraft ownership documents, and employee data, but the precise composition of any exfiltrated material in this case remains unconfirmed.

What's at stake

Exposure of internal files could affect business relationships, regulatory compliance, or personal information belonging to clients and staff, depending on what the files contain. For the organization, the incident adds to operational and reputational considerations common after ransomware activity. Individuals have no confirmed indication yet of how their specific information, if present, might be used.

What to do if you're exposed

Monitor accounts for unusual activity and consider changing passwords for any services linked to UAM or the aviation sector. Enable multi-factor authentication where available and review privacy settings on accounts that may hold related data. Readers can run a free exposure scan of their email to check whether their information has surfaced in known breach data.

AICompiled with AI assistance from public sources and published under our editorial standards.