On February 6, 2026, the ransomware group Incransom added aircotedivoire.com to its public leak site, claiming that it had exfiltrated internal files from the Ivorian national airline Air Côte d'Ivoire during a ransomware attack.
Already exposed?
You can’t unleak data. You can take away what it’s worth.
A leaked record is where it starts, not where it ends. What turns it into your front door is the look-up sites publishing your address beside your name — and those are what an AI reads when somebody asks about you. The free scan shows you both. We write to 580 companies.
See what is exposed about you — free scan →Watch aircotedivoire.com
Get alerted the next time aircotedivoire.com files a breach with any US regulator — the filing, dated and sourced. A free single-company slice of Signals; no account needed.
We’ll email you only about aircotedivoire.com’s future breach filings and how to watch a whole vendor list — not general marketing. Unsubscribe any time.
Watching your whole vendor list (50 to 500 companies, by tier) is GalaxyWarden Signals.
Reported Details of the Incident
Air Côte d'Ivoire, established in 2012 and based in Abidjan, Ivory Coast, operates direct flights across the region. The company employs approximately 1,000 people and generates annual revenue of roughly $40.5 million. Public reporting indicates the attackers gained access to internal documents and exfiltrated them before encrypting systems. The exact number of people whose information may have been exposed remains unknown, and the specific types of files posted have not been independently verified beyond the group's claims. The incident follows the group's typical pattern of listing victims after an initial extortion window expires.
Why This Matters for You and Your Family
When an airline's internal files are stolen, the data often includes employee records, customer booking details, vendor contracts, and contact information that can be traced back to ordinary people. If you or anyone in your household has flown with Air Côte d'Ivoire, works with the company, or shares an email address, phone number, or address that appears in those files, your information could now be circulating among criminals. Credential leaks from such breaches frequently cascade into account takeovers on other services where the same password or email was reused. For families this can mean sudden identity theft, fraudulent bookings, or targeted scams that affect everyone from grandparents to children.
The Doxxing and Identity-Chain Risks
Stolen internal files rarely stay isolated. Attackers or buyers on underground forums combine them with other leaks to build detailed profiles. A work email from the airline files can be linked to personal accounts, social-media handles, and even children's gaming usernames if the same credentials were reused at home. Once these connections are mapped, doxxing escalates quickly: harassment, SIM-swapping, or spear-phishing campaigns become straightforward. Public reporting shows that ransomware leaks like this one often feed long-term identity theft operations that can surface months or years later.