Madagascar Airlines Listed by The Gentlemen Ransomware Group

On February 19, 2025, Madagascar Airlines appeared on the leak site of the ransomware group known as thegentlemen. The listing indicates that internal files were exfiltrated during a ransomware attack on the national carrier, which operates flights from Antananarivo to major cities in Madagascar and maintains an online booking platform used by both local and international travelers.

What Public Reporting Shows

Public reporting on the incident remains limited. The primary evidence consists of the airline’s company profile and website address posted on the attackers’ dark-web leak page. No specific count of affected records has been disclosed, and the precise nature of the stolen files is not yet public. Available reporting describes the event as a ransomware attack that included successful data exfiltration. The listing carries the date February 19, 2025, and follows the group’s standard pattern of publishing victim details after an initial extortion window expires.

Why This Matters for You and Your Family

When an airline suffers a breach, the data at risk often includes customer names, contact details, booking histories, passport numbers, and payment information. If you or anyone in your household has flown with Madagascar Airlines, booked tickets online, or stored frequent-flyer details with them, those records may now sit in an attacker’s archive. Credential leaks from travel companies frequently cascade into other accounts because people reuse the same email-and-password combinations across services. A single exposed booking reference can give criminals enough context to impersonate you with customer service or reset passwords elsewhere.

The Doxxing and Identity-Chain Implications

Ransomware operators rarely stop at publishing raw files. Once internal documents are released, other threat actors scrape them for email addresses, phone numbers, and personal identifiers that can be chained to social-media handles, gaming accounts, and family-member records. This creates a doxxing chain: one leak supplies the seed data that unlocks further breaches and targeted harassment. Children’s gaming accounts are especially vulnerable because they are often registered with a parent’s email or linked to a shared family address, turning a corporate breach into a household privacy incident.