Russian ransomware operators Qilin have claimed to have broken into the Tulsa International Airport and stolen an unspecified amount of sensitive company data.
A report from Cybernews says the group recently added the airport to their data leak site, and included 18 samples as proof of their claims. The researchers analyzed the samples, finding it included C-suite emails, as well as email correspondence between executives and “high-level banking officials” outside the airport. The data also apparently includes copies of employee IDs, driver’s licenses, and passports, but also annual budget and revenue spreadsheets, confidentiality and non-disclosure agreements, telehealth reports, governance meeting minutes,etc.
Read more…
Source: TechRadar News
Sign up for the Cyber Security Review Newsletter
The latest cyber security news and insights delivered right to your inbox
Related:
- CISA has expanded the scope of its alert on Iranian-affiliated hackers attacking critical infrastructure
July 23, 2026
The US Cybersecurity and Infrastructure Security Agency (CISA) has expanded the scope of its alert on Iranian-affiliated hackers attacking critical infrastructure, including water and energy facilities. The original advisory focused on programmable logic controllers (PLCs) manufactured by Rockwell Automation/Allen-Bradley. The update warns that the activity may also target devices from Schneider Electric, Siemens, “and potentially other branded/manufactured PLCs.” The conflict between ...
- Russian State-Supported Cyber Actors Conduct Phishing Campaign Targeting Users of Zimbra Collaboration Suite
July 23, 2026
A group of Russian state-supported cyber actors has been targeting and compromising various Western government and commercial organizations using the Zimbra Collaboration Suite (ZCS) software since at least July 2025. The Russian state supported advanced persistent threat (APT) group’s activity is tracked in the cybersecurity community under several names (see Cybersecurity industry tracking), primarily as ...
- Experts warn hackers could shut down entire power grids by hijacking cloud accounts
July 21, 2026
Whenever an AI data center thinks really, really hard, it can increase its power consumption so much to trigger disruptions and possibly even blackouts and gear malfunctions. So, is it possible for a malicious actor to trigger this scenario deliberately, in order to cause physical harm? Multiple researchers from the Zhejiang University in Hangzhou, China, wrote ...
- Colombian energy giant Ecopetrol says thousands of user accounts hit in cyberattack
July 20, 2026
Latin American energy producer Ecopetrol has revealed it was victim of a ransomware attack, and while the threat actors managed to get away with sensitive data from thousands of user accounts, they were unable to deploy the encryptor and thus disrupt the company’s day-to-day operations. In a statement shared with the public, Ecopetrol explained how an ...
- Inside an Exposed WebDAV Malware Delivery Lab
July 20, 2026
An MDR alert recently led our team to an exposed server that was doing more than hosting payloads. It was functioning as a fully operational malware delivery lab. Containing over 1,000 artifacts, the infrastructure served as a QA hub where attackers systematically tested delivery paths, social engineering lures, and WebDAV execution methods. Our analysis reveals an ...
- FBI Warns of Scammers Impersonating the IC3
July 20, 2026
This Public Service Announcement contains updated information about an ongoing fraud scheme where criminal scammers are impersonating FBI personnel facilitating Internet Crime Complaint Center (IC3) complaints to deceive and revictimize individuals. This scheme combines several exploitation tactics to include the targeting of previous victims, the use of artificial intelligence (AI)-generated videos to create fictitious or misleading promotional ...