The Gentlemen Ransomware Claims 51,409 Air Canada Files; Airline Has Not Confirmed
The Gentlemen listed Air Canada on its dark-web leak site, claiming 51,409 critical files, attack dated 9 September. Air Canada has not publicly responded. A leak-site listing is not evidence of compromise. The group scales on a 90% affiliate split; initial access is mostly exposed edge devices.
Incident
On 9 September 2026, ransomware group The Gentlemen listed Air Canada on its dark-web leak site, claiming 51,409 critical files, attack dated the same day. As of publication, Air Canada has issued no public response and has not confirmed a data leak. A leak-site entry is the actor's advertisement. It is not proof of intrusion.
Claims vs. verifiable facts
- ransomware.live captured the listing at 22:08 UTC on 9 September, tagged Transportation. No downloadable data attached.
- AhnLab ASEC's weekly report lists a Gentlemen attack on "an unnamed Canadian airline." Supports the claim's shape, does not name the victim.
- Air Canada scale: ~37,000 employees; 45.3 million passengers in 2025.
Actor profile
The Gentlemen is a RaaS group that appeared mid-2025. It scaled fast on a 90% affiliate split. Microsoft tracks operators as Storm-2697. Third-party counts: 629 victim claims across 70 countries; 100 in the last 30 days, 25 in the last week. Among the highest-volume crews currently. Attack tempo is high: reports put affiliate time from initial access to encryption as short as two days. Disclosed entry points are mostly internet-exposed edge devices (VPN gateways, remote-access appliances), not novel 0-days.
This claim sits next to another high-profile listing this week: the group also claims 3.5 million Veradigm patient records, with an 11 September ransom deadline. Veradigm has confirmed a security incident involving patient PII.
Impact
Aviation is critical infrastructure. Leak of ops systems, passenger, or employee data can hit continuity and trigger regulatory notification. If The Gentlemen later posts samples, the claim becomes verifiable; silence leaves it as another unproven leak-site post. Trend is consistent either way: exposed-edge initial access plus a sub-48-hour encrypt window is compressing defender response time.
Remediation
- Inventory and patch all internet-exposed edge devices (VPN gateways, remote access, firewall management planes). Known primary entry for this group.
- MFA on every remote-access path. Disable idle accounts.
- Rehearse IR against a two-day window: shorten detect–triage–isolate. Offline-restorable backups.
- Least privilege on critical file servers and databases. Alert on anomalous bulk reads.
- On ransom contact: preserve evidence, notify regulators and law enforcement. Do not negotiate solo.
Sources
- IntelFusions: Ransomware crew says it stole 51,409 Air Canada files
- Secret CISO 9/10 briefing: Air Canada ransomware incident
- NeuraCyb: Veradigm data-breach analysis