Air Creebec, the Cree-owned regional airline based in Val-d’Or, Quebec, has confirmed that attackers broke into some of its administrative systems and exfiltrated files that may contain personal information on current and former employees and passengers. The company disclosed the incident on November 4, 2026, and said flight operations were not affected.
In its official notice and a press release distributed through CNW, Air Creebec said it “discovered an unauthorized intrusion targeting some of its administrative systems” and brought in cybersecurity experts as soon as the incident was found. The airline said it is working with the appropriate authorities.
What Air Creebec says was taken
According to the company, “initial findings indicate that administrative files were exfiltrated.” Air Creebec said the files may contain:
- Personal information relating mainly to current and former employees
- Personal information relating to passengers
- Operational, administrative or financial information related to customers and partners, including cargo and commercial clients
The airline has not said how many people are affected or which specific data fields were involved. “Our review is ongoing,” the notice states. President Tanya Pash said the company deeply regrets the concern the incident is causing “our employees, retirees, customers, partners and the communities we have the privilege of serving.”
Flights not affected
Air Creebec stressed that the safety of its flights, aircraft and flight operations “has not been compromised in any way.” The company said its aircraft and flight systems run independently of the affected administrative systems and that operations are continuing as normal.
Founded in 1982 and 100% owned by the Cree Nation of Eeyou Istchee, Air Creebec serves 16 destinations across Quebec and Ontario, including remote communities along James Bay such as Moosonee, Fort Albany, Kashechewan, Attawapiskat and Peawanuck. It operates 22 aircraft and carries more than 200,000 passengers a year.
When the intrusion happened is unclear
The official notice does not say when the intrusion began or when it was detected. Speaking to APTN News, Air Creebec marketing director Edward Trahan said the breach was identified in October. He said that because the attack was designed to go undetected, it was hard to determine when it started or how long the attackers had access. He added that the company does not yet know how the attackers got in and did not want to speculate while the review is underway.
Earlier Chaos ransomware claim
Air Creebec’s disclosure does not name an attacker or mention ransomware or encryption. However, the Chaos ransomware group listed aircreebec.ca on its data leak site on July 6, 2026, claiming to have stolen roughly 70 GB of data from the airline. That claim came about 3 months before the breach was identified, according to the company’s own account, and 4 months before the public notice.
Air Creebec has not linked the Chaos listing to the intrusion it disclosed, and BreachNews has not independently verified the group’s claim or the contents of any data it says it took. Air Creebec had not issued any public statement about the Chaos claim at time of publication. Chaos operates a double-extortion model, stealing data and threatening to publish it if a victim does not pay.
Credit monitoring under review
The company said it is assessing protective measures, including the possibility of offering credit monitoring and identity protection, “based on the nature of the information exposed and the risks identified.” Eligible individuals will be contacted directly with the available measures and the steps to follow. Trahan told APTN that affected people would likely be contacted within days.
Air Creebec said a dedicated phone line will be posted on its incident page, where future updates will also be published. Questions can be sent to communications@aircreebec.ca.
What employees, passengers and partners should do
- Treat unexpected emails, text messages or phone calls that ask for urgent action or confidential information with suspicion, especially messages that reference Air Creebec, bookings, payroll or invoices.
- Remember that Air Creebec says it will never contact anyone to ask for banking information or passwords.
- Monitor bank accounts, credit card statements and, for current and former employees, payroll and tax records for unusual activity.
- Cargo and commercial customers should verify any change to payment details or invoices through a known contact before sending money.
- Consider placing a fraud alert with Equifax Canada and TransUnion Canada if you believe your personal information was exposed.
Airlines and their suppliers hold large volumes of passenger and staff data, and breaches in the sector keep surfacing. Earlier incidents include the Amadeus breach that exposed booking data of JAL, ANA and Cathay Pacific passengers and the Manchester Airports Group data leak.
