Vumetric is now part of the TELUS family! Learn more →

Jet engine dealer to major airlines discloses ‘unauthorized activity’

Willis Lease Finance Corporation admitted that some internal processes have required workarounds to be developed so that it can continue to operate and service customers, without providing any specifics about what those workarounds entail.

As is often the case with early-stage ransomware disclosures, the company appears to be reluctant to mention “Ransomware” or even “Attack” in its wording.

The ransomware group claims to have stolen 910 GB worth of company data relating to customers, staff, HR, non-disclosure agreements, and more.

Black Basta posted a sample of documents online, including a screenshot of the file trees its affiliate claims to have accessed, as well as various HR documents that revealed the social security numbers of what appear to be company staff across various divisions and seniority levels.

Willis Lease Finance has been in operation for more than 45 years and claims to be one of the longest-standing independent sellers and lessors of jet engines to major airlines in the world.

Black Basta is one of the most dangerous ransomware operations in the cybercrime world and has claimed attacks on major organizations such as Capita and more recently the UK’s Southern Water.

Share this article on social media:

Subscribe to Our Newsletter!
Stay on top of cybersecurity risks, evolving threats and industry news.
This field is for validation purposes and should be left unchanged.

Recent News

Featured Services

The Latest Cybersecurity News

From major cyberattacks, newly discovered critical vulnerabilities to recommended best practices, read it here first:


Enter your Email Address

This field is for validation purposes and should be left unchanged.

* No free email provider (e.g:,, etc.)


Penetration Testing Buyer's Guide

Everything You Need to Know

Gain full confidence in your future cybersecurity assessments by learning to plan, scope and execute projects.
This site is registered on as a development site. Switch to a production site key to remove this banner.