AeroWorx Listed by frag Ransomware Group

On November 19, 2024, aviation maintenance firm AeroWorx appeared on the leak site of the frag ransomware group. The listing states that internal files were exfiltrated during a ransomware attack on the FAA-certified repair station that specializes in pneumatic, hydraulic, electromechanical, and fuel systems. Anyone whose employment, contractual, or personal records passed through AeroWorx now faces the possibility that their information sits in an attacker-controlled archive.

Reported Details from the Listing

The frag leak site, archived on ransomware.live, explicitly lists AeroWorx and describes two categories of stolen material. The first includes corporate internal documents, agreements, and financial statements. The second, labeled by the attackers as “the icing on the cake,” contains non-disclosure agreements along with employee passports and other personal documents. The disclosure does not quantify the number of records, name specific data fields beyond those categories, or state whether customer data was taken. It simply states that exfiltration occurred and that the files are now in the group’s possession.

Why This Matters for You and Your Family

When an employer’s internal repository is stolen, the exposure rarely stops at the company name. Employee passports, NDAs, and financial statements often contain full legal names, dates of birth, passport numbers, home addresses, and signatures. If you or a family member worked at AeroWorx, contracted with them, or had your information included in their vendor or partner files, those details can be used to open accounts, file fraudulent tax returns, or impersonate you in official correspondence. Even if the exact number of affected individuals remains unknown, the presence of scanned identity documents raises the probability that real-world fraud will follow.

The Doxxing and Identity-Chain Risk

Passports and NDAs do not exist in isolation. A single leaked document can link an email address to a physical address, a phone number, and a date of birth. Attackers then cross-reference those details across other breaches to build a complete identity chain. The same credentials used for an AeroWorx portal may also protect personal email, banking, or social-media accounts. Once one account falls, the rest collapse in sequence. Children’s gaming accounts tied to a parent’s email or address are especially vulnerable because gaming platforms rarely enforce the same verification standards as financial services. A single leaked corporate file can therefore cascade into doxxing that reaches every member of the household.

Frag Ransomware Group’s Known Track Record

Public reporting attributes the emergence of frag to mid-2024. The group has focused primarily on mid-sized manufacturing, engineering, and professional-services targets. Its publicly documented playbook follows a now-familiar pattern: initial access through phishing or exploited remote-desktop services, followed by exfiltration of sensitive files before encryption. Rather than immediately publishing everything, frag typically posts samples on its leak site and pressures victims with escalating deadlines. The AeroWorx listing fits this pattern exactly—corporate files mixed with personal identity documents intended to increase reputational and regulatory pressure.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, then use the cleanup of Warden to remove what you can.
• Rotate any password you ever used at AeroWorx or on systems that shared the same credentials, and switch to 2FA through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure surfaces in hours instead of months.
• Cover the household—DoxxScan family coverage extends to dependents and children’s gaming accounts that often chain back to the same breached corporate address or email domain.
• Let remediation specialists handle ongoing takedown requests for any exposed personal documents appearing on data-broker or extortion sites.

The AeroWorx incident shows once again that a single corporate breach can place your family’s most sensitive identity documents into criminal hands within days. Acting quickly on the exposed data chain gives you the best chance of limiting damage before fraudsters put the stolen passports and agreements to use. Start your DoxxScan trial today; its continuous monitoring, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage—including children’s gaming accounts—provide the practical protection needed when corporate defenses fail.