aircotedivoire.com Listed by incransom Ransomware Group

On February 6, 2026, the ransomware group Incransom added aircotedivoire.com to its public leak site, claiming that it had exfiltrated internal files from the Ivorian national airline Air Côte d'Ivoire during a ransomware attack.

Reported Details of the Incident

Air Côte d'Ivoire, established in 2012 and based in Abidjan, Ivory Coast, operates direct flights across the region. The company employs approximately 1,000 people and generates annual revenue of roughly $40.5 million. Public reporting indicates the attackers gained access to internal documents and exfiltrated them before encrypting systems. The exact number of people whose information may have been exposed remains unknown, and the specific types of files posted have not been independently verified beyond the group's claims. The incident follows the group's typical pattern of listing victims after an initial extortion window expires.

Why This Matters for You and Your Family

When an airline's internal files are stolen, the data often includes employee records, customer booking details, vendor contracts, and contact information that can be traced back to ordinary people. If you or anyone in your household has flown with Air Côte d'Ivoire, works with the company, or shares an email address, phone number, or address that appears in those files, your information could now be circulating among criminals. Credential leaks from such breaches frequently cascade into account takeovers on other services where the same password or email was reused. For families this can mean sudden identity theft, fraudulent bookings, or targeted scams that affect everyone from grandparents to children.

The Doxxing and Identity-Chain Risks

Stolen internal files rarely stay isolated. Attackers or buyers on underground forums combine them with other leaks to build detailed profiles. A work email from the airline files can be linked to personal accounts, social-media handles, and even children's gaming usernames if the same credentials were reused at home. Once these connections are mapped, doxxing escalates quickly: harassment, SIM-swapping, or spear-phishing campaigns become straightforward. Public reporting shows that ransomware leaks like this one often feed long-term identity theft operations that can surface months or years later.

Incransom's Publicly Known Track Record

Public reporting attributes Incransom with emerging in late 2024 and following a double-extortion model. The group typically gains initial access through phishing or exploited remote desktop protocols, exfiltrates sensitive files, deploys ransomware to encrypt systems, then demands payment to prevent publication. Notable prior victims listed on their leak site include organizations across transportation, healthcare, and manufacturing sectors. Their playbook emphasizes publishing samples of stolen data on their Tor blog when victims do not meet extortion deadlines, a pattern consistent with the February 6, 2026 listing of aircotedivoire.com.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, handles, and real-world identity so you can see exactly what chains back to the Air Côte d'Ivoire breach.
• Rotate any password you ever used at aircotedivoire.com or related airline services, then enable two-factor authentication through an authenticator app on every account where that password was reused.
• Enable continuous DoxxScan monitoring across 13.1 billion+ breach records and more than 100 platforms so the next leak exposing you or your family is flagged within hours rather than months.
• Cover the entire household with DoxxScan family protection, which extends to dependents and children's gaming accounts that often become entry points for doxxing chains when credential leaks occur.
• Let remediation specialists handle takedown requests for any exposed personal records that surface on data-broker sites or underground forums.

The Air Côte d'Ivoire breach is a reminder that even mid-sized companies handling everyday travel data can become gateways for larger identity crimes. Taking concrete steps now limits how far attackers can travel down the chain that begins with this leak. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1B+ breach records and 100+ platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that includes children's gaming accounts—practical protection that turns early awareness into effective defense for you and your family.