Air Arabia DataBase on sale for $2 Million Listed by everest Ransomware Group

On October 25, 2025, the Everest ransomware group listed an alleged Air Arabia database for sale on its leak site, demanding $2 million for the internal files it claims to have exfiltrated during a ransomware attack on the Middle East-based airline.

What's Publicly Reported from Reporting

Public reporting indicates the Everest group posted details of the Air Arabia incident on its dark-web leak portal, accessible via the address hosted on the ransomware.live tracker. The listing states that internal files were taken during a ransomware deployment, though the exact number of people affected remains unknown. Available reporting describes the data as internal files rather than a specific customer record count or structured database of passenger information. No independent verification of the claim has been published by Air Arabia at the time of writing, and the airline has not issued a public statement confirming the breach.

The post appeared on the group’s official leak site, a common tactic used by ransomware operators to pressure victims into payment. The $2 million asking price is listed without a public countdown timer in the available screenshots, though Everest frequently pairs such listings with deadlines in other incidents.

Why This Matters for You and Your Family

When an airline’s internal systems are compromised, the information at risk often includes more than just flight bookings. Names, contact details, passport numbers, travel histories, and payment records can appear in exfiltrated files. If your family has flown with Air Arabia or used related services, fragments of your data may now sit on a criminal marketplace. Once sold, that information rarely stays isolated. Buyers combine it with other leaks to build detailed profiles that enable identity theft, fraudulent bookings, or targeted scams against you or your children.

Credential leaks like this one frequently cascade into account takeovers elsewhere. A password or email address reused from an airline booking can unlock access to your banking, email, or social media. Children’s accounts tied to family email addresses are especially vulnerable because gaming platforms and app stores often share the same login details parents use for travel bookings.

The Doxxing and Identity-Chain Implications

Ransomware groups rarely stop at stealing one company’s data. They exfiltrate whatever they can reach, then auction or publish it to maximise pressure. In this case, the internal files could contain employee records, vendor contracts, or customer spreadsheets that link names to addresses, phone numbers, and frequent-flyer identifiers. These connections form identity chains that allow criminals to map your online handles back to your real-world identity.

Once such chains exist, doxxing becomes straightforward. A single exposed email can reveal linked gaming accounts, social profiles, and family member details. Public reporting shows that data sold on ransomware leak sites often resurfaces months later on additional criminal forums, prolonging the exposure window for you and your household.

Everest Ransomware Group Track Record

Public reporting attributes the Everest ransomware operation to a group that emerged in 2021. It has since targeted hospitals, manufacturers, logistics companies, and travel organisations across multiple countries. Notable prior victims include healthcare providers and industrial firms whose data was published after ransom demands went unpaid. The group’s typical playbook involves initial access through phishing or exploited remote desktop services, followed by lateral movement inside the network, data exfiltration, and deployment of ransomware to encrypt systems. They then publish samples on their leak site and demand payment, often escalating pressure by contacting journalists or the victim’s customers. Everest usually sets payment deadlines measured in days or weeks and threatens full data release if the ransom is not met.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, travel accounts, and real identity so you can see exactly what chains exist from this incident.
• Rotate any password you used on Air Arabia or related travel sites anywhere it is reused, and switch on two-factor authentication through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next leak exposing you or your family is caught in hours, not months.
• Cover the household with DoxxScan family protection that extends to dependents and children’s gaming accounts which often chain back to the same addresses and logins.
• Let remediation specialists handle takedown requests for any exposed personal records that appear on data broker sites or criminal forums.

The Air Arabia listing is a reminder that travel data is valuable to criminals precisely because it connects so many parts of daily life. Acting quickly on credential hygiene and identity mapping reduces the chance that this claimed breach becomes the first link in a longer chain of compromise. Start your DoxxScan trial and let its continuous monitoring, AI-powered identity-chain mapping, hands-on remediation by specialists, and household coverage—including children’s gaming accounts—work for your family before the next leak appears.