Air Creebec, the regional airline based in Val-d'Or, Quebec, confirmed on November 4, 2026 that attackers broke into some of its administrative systems and stole files. The company says the files may contain personal information on current and former employees and on passengers, along with operational, administrative or financial records tied to customers and business partners. Air Creebec says flights, aircraft and flight systems were not affected and run separately from the breached systems. The airline has not said how many people are affected or exactly which data fields were taken. No group has publicly claimed the attack, and no regulator filing has been published.
What Happened
Air Creebec announced the breach in a press release distributed through CNW on November 4. It said it had "discovered an unauthorized intrusion targeting some of its administrative systems," brought in outside cybersecurity experts to assess the scope and secure the affected systems, and is "working with the appropriate authorities."
The airline's statements give a rough timeline. Edward Trahan, Air Creebec's director of marketing and business development, told TimminsToday the intrusion was detected "in the very last days of October," and told APTN News that it was identified in October. TimminsToday's headline says the breach is "believed to have started in October," but Trahan's own words were more cautious. He said the attack was "designed to go undetected," which makes it hard to know when the attackers first got in. October is when the breach was detected. The start date of the intrusion has not been established, and the attackers may have been inside the network for some time before then.
Trahan told APTN that, for security reasons, he would not name the incident response firm helping the airline. He told TimminsToday there is no timeline yet for finishing the review. "We don't want to speculate as to how much has been leaked until we actually know for sure," he said.
Air Creebec is wholly owned by the Cree Nation of Eeyou Istchee. According to APTN News, it flies to 16 destinations in Quebec and Ontario with 21 Dash-8 turboprops and one ATR 72 freighter, and carries about 200,000 passengers a year. Actu.Québec, citing Les Affaires, puts the figure at more than 200,000. Northern Ontario Business notes that the airline runs a hub in Timmins and serves Moosonee, Fort Albany, Kashechewan, Attawapiskat and Peawanuck. For many of these remote communities, it is a key transport link.
What Was Taken
The company's press release says "initial findings indicate that administrative files were exfiltrated." Actu.Québec stresses that word: the data was copied out of the network, so this is theft and not just unauthorised access. According to Air Creebec, the stolen files may include:
- Personal information mainly about current and former employees. Company president Tanya Pash specifically mentions retirees among those affected.
- Personal information about passengers.
- Operational, administrative or financial information tied to customers and partners. Breachnews.com describes this as covering cargo and commercial clients.
What has not been disclosed:
- Number of people affected. Trahan told APTN that "there's no numbers [of victims] at this time that we can give."
- Specific data fields. No outlet has reported whether the files hold Social Insurance Numbers, banking details, passport or ID data, or health and benefits records. TimminsToday and Actu.Québec both note that the company has not said exactly what was taken.
- Attacker identity or extortion. No ransomware group has claimed the attack, and the airline has not said whether any ransom demand was made.
Even so, the offer of protection services tells us something. Air Creebec says it is considering credit monitoring and identity protection "based on the nature of the information exposed." That suggests at least some of the files contain identity or financial data, though the company has not confirmed this. Les Affaires, carrying a Canadian Press report, says a dedicated phone line will open soon. Affected people will be contacted directly.
Why It Matters
HR data has a long shelf life. Files on current and former employees, including retirees, usually hold the most sensitive identity data a company keeps: payroll and tax records, government ID numbers, banking details for direct deposit, and benefits information. Retirees may be easier to defraud, because they are less likely to be watching an employer they left years ago.
Small, close-knit communities face targeted scams. Air Creebec serves remote Cree and northern communities where the airline is a familiar, trusted name. A stolen passenger list lets scammers send convincing messages posing as the airline, with real names, routes and travel dates. The company has warned about exactly this, saying it "will never contact anyone to ask for banking information or passwords."
Partner and cargo data opens the door to invoice fraud. Financial and operational records for commercial and cargo clients are what attackers need for business email compromise: fake invoices, requests to change bank details, and impersonation of known contacts.
Aviation keeps getting hit. Actu.Québec places the breach within a wider wave of attacks on aviation from Europe to Asia. The airline's separation of flight systems from administrative IT appears to have kept operations running. That design lesson is worth noting, but it did nothing to protect the data.
The Attack Technique
Air Creebec has not said how the attackers got in. It has not named a malware family, a vulnerable product, or a group, and no threat actor has claimed responsibility.
The few details available are these:
- Stealth was the goal. Trahan described an attack "designed to go undetected." That fits a careful intrusion focused on data theft, not a fast, noisy encryption attack. The airline has not mentioned any encryption or system outage.
- Data was taken out of the network. The company confirms the files were exfiltrated, so the attackers had a path to move data outside the network without being caught.
- Network separation held. The company says aircraft and flight systems "operate independently, separately from the affected administrative systems," and operations continued normally.
A quiet break-in, data theft, and no reported encryption is a pattern seen in many extortion-only campaigns. But the company has not confirmed that this is an extortion case, and readers should not assume it is until a claim or more disclosure appears.
What Organizations Should Do
- Treat HR and former-employee records as top-value targets. Find out where payroll, tax and benefits files sit on administrative file shares. Apply retention limits so data on long-departed staff is archived offline or deleted, not kept on reachable servers.
- Watch for data leaving the network, not just for malware. Alert on unusual outbound volumes, archive utilities running on file servers, and connections to cloud storage or file-transfer services. Exfiltration-focused attacks are built to slip past endpoint tools tuned for ransomware.
- Keep segmenting, and test it. Air Creebec's separation of flight systems from IT appears to have kept planes flying. Check regularly that safety-critical and operational networks cannot be reached from compromised office systems.
- Lock down vendor payment changes. If partner or customer financial data may be exposed, require call-back confirmation on a known number before changing any banking details, and warn finance staff about invoice fraud using real transaction details.
- Prepare impersonation warnings in advance. Have plain-language notices ready, in every language your customers use, that spell out what the organisation will and will not ask for. Publish them as soon as a breach is disclosed, before the scams start.
- If you are an affected employee, retiree, passenger or partner: be wary of any message claiming to be from Air Creebec that asks for urgent action or confidential details. Monitor bank and credit statements, report unusual transactions to your bank, and wait for direct contact from the airline about credit monitoring eligibility.
Sources: Air Creebec Confirms Breach of Employee and Passenger Files | Air Creebec confirms cybersecurity intrusion affecting some of its... | Air Creebec data breach believed to have started in October - Timmi... | Air Creebec data breach affecting employees and passengers | Air Creebec reports cyber hack affecting customer and employee file... | Air Creebec investigating cybersecurity breach - TimminsToday.com | Air Creebec victime d’une «intrusion informatique» visant des fichi... | Air Creebec confirme le vol de fichiers administratifs, dans un sec...