Claimed leak at OSAC (Civil Aviation) - Ransomware - see details

On 20 February 2026, OSAC — the Organisme pour la Sécurité de l'Aviation Civile, France's delegated body for civil-aviation safety oversight and airworthiness certification — was named by the LAPSUS$ extortion group, which announced via Telegram that it had breached the organisation and exfiltrated roughly 420 GB of data.

LAPSUS$ is known for social-engineering, stolen-credential and compromised-account intrusions rather than file-encrypting ransomware, and this case followed the same data-theft-and-extortion pattern. After the initial claim, the group published the complete 420 GB dataset online in retaliation, making the stolen material openly available rather than merely offering it for sale.

According to the threat actor's claims, the exposed data spanned highly sensitive personal and corporate material:

• Identity documents (national ID cards, passports)
• Diplomas and proof-of-residence documents
• User and email lists
• Internal documents referencing Airbus, Dassault, Thales, Boeing, the U.S. FAA and the French Army

OSAC acknowledged the incident, put its website into maintenance, and emailed users a reassuring message that largely downplayed the impact, describing the affected material as mainly manuals, procedures and "personal data." As of reporting, no full independent confirmation of the dataset's contents had been issued by OSAC or French authorities, and the leaked data — which exposes affected individuals to identity theft, document fraud, targeted phishing and social-engineering risk — remained in circulation.