--- title: "STS Aviation Group 2025 systems data incident" description: "STS Aviation Group disclosed personal information obtained during an August 2025 systems intrusion." incident_type: "Data incident" status: "active" last_modified: "2026-10-20" canonical_url: "https://www.ally.security/incidents/sts-aviation-group-systems-data-incident-2025" markdown_url: "https://www.ally.security/incidents/sts-aviation-group-systems-data-incident-2025.md" stix_url: "https://www.ally.security/incidents/sts-aviation-group-systems-data-incident-2025/stix.json" --- # STS Aviation Group 2025 systems data incident A 2025 intrusion led to an October 2026 notification after an extended investigation. Last modified Oct 20, 2026 · 1 source ## Summary - **Environment:** STS Aviation Group systems - **Operational impact:** Personal information obtained; no operational outage established - **Financial impact:** No incident cost established in the reviewed evidence ## What happened [STS Aviation Group](https://www.stsaviationgroup.com/) identified a cyber incident on September 12, 2025 involving system access around August 5. Its [October 19, 2026 notice](https://oag.ca.gov/system/files/STS%20-%20Sample%20Individual%20Notice_0.pdf) says investigators determined on September 19, 2026 that an intruder had obtained personal information. [1](#source-1) ## Impact Depending on the individual, information included names, contact details, birth dates, government IDs, financial or payment-card details, medical or insurance information, fingerprints, race or ethnicity, and employment information. The notice does not give a total affected population. [1](#source-1) ## Timeline ### September 12, 2025 — Cyber incident identified STS began investigating the earlier access. [1](#source-1) ### September 19, 2026 — Personal-information impact determined Investigators determined that personal information had been obtained. [1](#source-1) ### October 19, 2026 — Individual notice dated The [notification letter](https://oag.ca.gov/system/files/STS%20-%20Sample%20Individual%20Notice_0.pdf) describes the findings. [1](#source-1) ### October 20, 2026 — Briefing updated This briefing was last reviewed and updated on October 20, 2026. ## Threat Group & Attack Vector The initial access method and attacker identity are not established. ### Actors - No threat actor group has been identified in the reviewed public evidence. ### TTPs - No specific MITRE ATT\&CK technique is currently mapped for this case. ## Response STS said it blocked access, engaged external cybersecurity experts, strengthened safeguards and informed law enforcement. It offered two years of identity protection and credit monitoring. [1](#source-1) ## Assets [Download the case-scoped STIX 2.1 bundle]() ## Sources Primary source records used to research this incident. ### STS Aviation Group notice of data breach official · STS Aviation Group · Oct 19, 2026
Evidence ledger Review the supporting structured claims. 1. **Exposed Data Category · 100% confidence · current** Personal information described in the notification: Government-issued identifiers 2. **Discovered At · 100% confidence · current** STS Aviation Group 2025 systems data breach: 2025-09-12 3. **Affected Organization · 100% confidence · current** STS Aviation Group 2025 systems data breach: STS Aviation Group 4. **Exposed Data Category · 100% confidence · current** Personal information described in the notification: Biometric identifiers 5. **Exposed Data Category · 100% confidence · current** Personal information described in the notification: Financial account information 6. **Exposed Data Category · 100% confidence · current** Personal information described in the notification: Clinical information 7. **Exposed Data Category · 100% confidence · current** Personal information described in the notification: Health insurance information 8. **Occurred At · 100% confidence · current** Cyber incident identified: 2025-09-12 9. **Exposed Data Category · 100% confidence · current** Personal information described in the notification: Payment card information 10. **Resulted In · 100% confidence · current** STS Aviation Group 2025 systems data breach: Personal-information acquisition determined 11. **Resulted In · 100% confidence · current** STS Aviation Group 2025 systems data breach: Cyber incident identified 12. **Exposed Data Category · 100% confidence · current** Personal information described in the notification: Dates of birth 13. **Exposed Data Category · 100% confidence · current** Personal information described in the notification: Names 14. **Occurred At · 100% confidence · current** Individual notice dated: 2026-10-19 15. **Exposed Data Category · 100% confidence · current** Personal information described in the notification: Contact information 16. **Exposed Data Category · 100% confidence · current** Personal information described in the notification: Employment information 17. **Resulted In · 100% confidence · current** STS Aviation Group 2025 systems data breach: Individual notice dated 18. **Resulted In · 100% confidence · current** STS Aviation Group 2025 systems data breach: STS said an unauthorized party accessed certain systems on or around August 5, 2025. 19. **Occurred At · 100% confidence · current** Personal-information acquisition determined: 2026-09-19 20. **Resulted In · 100% confidence · current** STS Aviation Group 2025 systems data breach: Personal information described in the notification 21. **Resulted In · 100% confidence · current** STS Aviation Group 2025 systems data breach: STS blocked the unauthorized access, engaged external cybersecurity experts, strengthened safeguards and reported the matter to law enforcement. 22. **Exposed Data Category · 100% confidence · current** Personal information described in the notification: Demographic information 23. **Resulted In · 100% confidence · current** STS Aviation Group 2025 systems data breach: On September 19, 2026, STS determined that an unauthorized party had obtained certain personal information. 24. **Resulted In · 100% confidence · current** STS Aviation Group 2025 systems data breach: STS offered two years of identity protection and credit monitoring.