Possible EgyptAir Cyberattack: 104,000 Records and Sensitive Documents Allegedly For Sale
Published on February 9, 2026
Key Takeaways
- Database Sale: Threat actor "quellostanco" claims to be selling a database of approximately 104,000 records allegedly stolen from EgyptAir on a cybercrime forum.
- Compromised Data: The reported dataset includes HR and recruitment records, cleartext passwords for user and admin accounts, national ID numbers, and staff email documents.
- Hacker Claims: The post also advertises the sale of sensitive documents.
A significant EgyptAir cyberattack has allegedly targeted the national flag carrier of Egypt, with a threat actor advertising stolen data on the dark web. The individual, operating under the pseudonym "quellostanco," posted on a cybercrime forum, claiming to possess a full database extracted from the airline's systems.
While the breach is currently pending verification, the detailed nature of the advertised dataset suggests a potentially severe compromise of internal networks.
EgyptAir Data Breach
The scope of this reported EgyptAir data breach appears extensive. According to the forum post, the compromised dataset contains approximately 104,000 records derived primarily from HR and recruitment systems.
The exposed information allegedly includes:
- Employee and applicant data,
- user and admin accounts with cleartext passwords,
- national ID numbers,
- personal details,
- documents from staff email inboxes.
Implications for Aviation Cybersecurity
If valid, the exposure of cleartext passwords indicates a failure in basic credential management protocols. This incident underscores the growing vulnerability of aviation cybersecurity infrastructure, as the airline industry relies heavily on interconnected digital systems for recruitment and operations.
In October 2025, the Cl0p Ransomware group claimed an American Airlines breach, and Scattered Spider targeted the Vietnam Airlines CRM to steal government records.
A report last month highlighted that dozens of global companies were breached through infostealer credentials, including those inaviation, defense, and engineering.
Related
Get expert insights on threats, breaches, scams, and security trends — delivered every Monday.
Most Popular
Get expert insights on threats, breaches, scams, and security trends — delivered every Monday.
Most Popular