Mexican airport operator purportedly breached by RansomHub

Mexico’s Grupo Aeroportuario del Centro Norte (OMA), which manages over a dozen airports across the country, has reportedly fallen victim to the RansomHub ransomware operation. The threat actors have claimed responsibility for the breach, alleging possession of 3 TB of sensitive data and warning of its exposure should the company fail to comply with their ransom demands, according to The Record, a cybersecurity news outlet by Recorded Future.
OMA acknowledged the incident and confirmed the activation of backup systems to maintain operational continuity at airports in northern and central Mexico. However, the organization did not verify RansomHub’s claims. “We have progressively restored certain services while continuing to work with cybersecurity experts to protect the integrity of our systems. As of today, we have not identified any significant adverse impact on the company’s operations or financial standing, though we remain vigilant in monitoring and assessing potential ongoing effects,” OMA stated.
This incident follows Microsoft’s recent identification of RansomHub as one of the predominant ransomware payloads used in cyberattacks.