- Everest ransomware claims it stole 4.36GB of data from FlyDubai, including 2,862 employee records.
- The alleged data includes pilot training materials, operational directives, and records spanning 2009 to 2020.
- Everest also claims it has Boeing software source code and confidential aviation documents.
- Cybernews researchers warn the alleged leak could support phishing, social engineering, and legal or reputational risks.
Key Takeaways by nexos.ai, reviewed by Cybernews staff.
FlyDubai’s cockpit secrets may soon hit the dark web, with the Everest ransomware threatening to dump pilot training data and Boeing’s proprietary code.
The Everest ransomware gang has listed the UAE airline FlyDubai on its dark web leak site.
So far, the gang has not released any screenshots with data samples to prove its claims. However, it did post an extensive list of data points allegedly exfiltrated, which includes pilots’ personal and training data.
According to the attackers, a total of around 4.36GB of exfiltrated data includes the personal information of 2,862 FlyDubai employees across 17,053 records.
The records allegedly expose data on cover pilots, cabin crew, training managers, technical pilots, dispatchers, and ground staff, and span from 2009 to 2020.
Attackers claim that the exfiltrated data includes:
- Full names
- Employee IDs
- Job titles
- Employment start and end dates
- Training completion dates and qualification check records
The attackers have set a 6-day timer for the company to negotiate – a common tactic to pressure the victim.
According to Cybernews researchers, if the data proves legitimate and is leaked, it may pose multiple risks to the company and its individuals.
“Such information could be useful for competitors. The company may face reputational damage and legal risks,” one researcher explained.
There’s also the risk of phishing and social engineering attacks.
“With such information at hand, threat actors might attempt to phish FlyDubai employees, which may lead to a breach affecting other data, including customer data,” the researcher added.
We’ve reached out to FlyDubai and will update this article once we receive a response.
FlyDubai pilot training material stolen
Apart from the personal data of the FlyDubai crew, Everest boasts of having exfiltrated a large amount of pilot training materials.
The dataset includes a full Boeing 737NG interactive training course with thousands of lesson modules with animations, audio narration, and quizzes.
The course covers every aircraft system from engines to autopilot, navigation, emergency equipment, fire protection, and landing gear.
The dataset also includes recurring training presentations on critical topics such as:
- How to inspect an aircraft before departure
- Flying over oceans (ETOPS long-range operations)
- Winter flying – de-icing, frozen runways, cold weather hazards
- Landing in fog and low visibility
- Takeoff and landing performance calculations
- Weather radar interpretation – detecting hail, turbulence, windshear
- Using iPads and electronic flight bags in the cockpit
- Navigating into challenging airports (e.g., Kathmandu with mountainous terrain)
- Dangerous goods awareness
- Baggage weight and loading procedures
- TCAS collision-avoidance system updates
The dataset also allegedly includes numbered operational directives covering policy changes, such as:
- When pilots can or cannot land on icy runways
- How to set altimeters correctly
- How to handle de-icing fluid procedures
- Baggage reconciliation problems at Dubai airport
Boeing’s
Everest claims to have a complete installation package for Boeing’s Performance Engineers Tool (PET 3.2) on hand. The software calculates takeoff weights, landing distances, fuel planning, obstacle clearance, and engine-out scenarios.
The dataset allegedly includes 2,827 Javaare. Just over 2,000 of those files are marked “Boeing Proprietary, Confidential, and/or Trade Secret.”
Files also include database templates for airport and runway data. The release notes list 10 known software bugs, including incorrect unit conversions when mixing weight/fuel units, airport data being overwritten despite a “preserve” setting, and calculations failing silently after data imports.
You don’t have to keep an eye on this by yourself. Here’s what’s included:
- 24/7 dark web monitoring for exposed personal information
- Credit and financial alerts if suspicious activity is detected
- Automatic data removal from public data-broker websites
*Insurance covers losses from misuse of your data after your plan starts. It doesn’t cover past breaches, including the ones shown above.
