Summary
- Environment: STS Aviation Group systems
- Operational impact: Personal information obtained; no operational outage established
- Financial impact: No incident cost established in the reviewed evidence
- Record status: Developing record. Reviewed October 20, 2026; updated as evidence emerges.
What happened
STS Aviation Group identified a cyber incident on September 12, 2025 involving system access around August 5. Its October 19, 2026 notice says investigators determined on September 19, 2026 that an intruder had obtained personal information. [1]
Impact
Depending on the individual, information included names, contact details, birth dates, government IDs, financial or payment-card details, medical or insurance information, fingerprints, race or ethnicity, and employment information. The notice does not give a total affected population. [1]
Timeline
Cyber incident identified
STS began investigating the earlier access.
[1]Personal-information impact determined
Investigators determined that personal information had been obtained.
[1]Individual notice dated
The notification letter describes the findings.
[1]Briefing updated
This briefing was last reviewed and updated on October 20, 2026.
Threat Group & Attack Vector
The initial access method and attacker identity are not established.
Actors
- No threat actor group has been identified in the reviewed public evidence.
TTPs
- No specific MITRE ATT&CK technique is currently mapped for this case.
Response
STS said it blocked access, engaged external cybersecurity experts, strengthened safeguards and informed law enforcement. It offered two years of identity protection and credit monitoring. [1]