Air Creebec Confirms intruders took administrative files with Employee and passenger data

Air Creebec confirmed on Nov. 4, 2026 that intruders took administrative files containing personal details about current and former employees and passengers from some of its administrative systems.

The airline said it found an unauthorized intrusion targeting some administrative systems, but that flight safety was not compromised and flights are operating normally. The company said aircraft and flight systems are separate from the administrative systems affected.

Initial findings indicate administrative files were exfiltrated from the airline’s systems. Some files may include personal information about current and former employees above all, while other files may hold personal information about passengers. Other files may hold operational, administrative or financial details linked to customers and partners. The airline has not disclosed how many people were affected or which specific data fields were involved.

Air Creebec made the incident public on Nov. 4, 2026. The company’s notice does not give a date for when the intrusion began or for when it was detected. Edward Trahan, the airline’s marketing director, said in October that the intrusion had been found.

Trahan said that because the attackers tried to stay hidden, pinpointing when the access began or how long it lasted is difficult. Air Creebec says it does not know how the intruders got in and will not speculate while the review continues.

Chaos ransomware actors posted the airline’s website, aircreebec.ca, to a leak site on July 6, 2026 and said they had taken about 70 GB of data. The post preceded the October discovery Trahan described.

DataBreach.com puts the number of people with records exposed in the July 2026 cyber attack at roughly 49,747. Full names appear in nearly all of those records, according to the site, which also says birth dates were recorded for about 35,482 individuals, phone numbers for about 25,871 people, e-mail addresses for about 21,062 and street addresses for about 22,842. Not everyone had every type of data in the records, DataBreach.com cautions.

The site characterizes the data as personal rather than financial and says it could help criminals build convincing scams. Birth dates and addresses, it says, answer common questions used to verify someone’s identity. People with passport or social insurance identifiers appearing in small numbers face higher exposure, it adds.

Attackers holding those details could let criminals take over accounts, open fake accounts or impersonate victims at banks, phone carriers and government services, DataBreach.com says. The site says the incident could raise concerns about sensitive travel information for people on remote-community and medical transport flights, though no public record confirms what operational information was taken.

Air Creebec brought in cybersecurity experts immediately after the discovery to assess the scope of the incident and strengthen the affected systems. The airline is working with appropriate authorities while its review continues.

The airline says it is reviewing possible credit monitoring and identity protection as protective steps, weighing the exposed information and the identified risks. People who are eligible will get direct notice of the measures available to them and the steps to follow. Trahan said people affected by the intrusion should expect to be contacted directly within days.

Tanya Pash, the airline’s president, said the company regrets the worry the incident is causing staff, retirees, customers, partners and communities. She said Air Creebec takes the situation seriously and is committed to supporting people affected. “Air Creebec takes this situation very seriously and is committed to supporting the people affected.”

Trahan said 100 per cent protection is impossible in cybersecurity. He said the cybersecurity team was working to close every possible entry point. He said security concerns keep him from naming the cybersecurity team helping with recovery.

The airline said it will never ask anyone for banking information or passwords. People should check their accounts and statements and report unusual activity to their financial institution. They should also treat unexpected e-mails, texts or calls demanding urgent action or confidential information with suspicion. If personal information was exposed, people can consider asking Equifax and TransUnion for a fraud alert.

The incident page will soon carry a dedicated phone line and future updates. Anyone with questions can e-mail communications@aircreebec.ca. Self-protection advice and tools are posted at aircreebec.ca/cybersecurity-incident.

Air Creebec, founded in 1982, is a regional airline owned by the Cree and based in Val-d’Or, Quebec. The Cree Nation of Eeyou Istchee owns 100 per cent of the airline. Its network covers 16 destinations in Quebec and Ontario, including Moosonee, Fort Albany, Kashechewan, Attawapiskat and Peawanuck. It operates 22 aircraft that carry more than 200,000 passengers per year, runs an Ontario hub in Timmins, and flies scheduled routes and charters, carries cargo and provides medical air transport for remote communities.