Servicios Aereos Estrella Data Breach

thegentlemen listed Servicios Aereos Estrella, a Mexican transportation company, as a claimed victim on August 30, 2026. SOCRadar CTI identified 16 compromised credentials in stealer-log datasets, including 6 employee credentials for M365, admin portals, and Apple services, alongside 10 corporate third-party credentials. The most recent activity associated with these credentials was dated August 26, 2026, just four days prior to the ransomware group’s listing. This situation is noteworthy as active credential exposure occurring within four days of a ransomware publication suggests that the access pipeline was operational at the time of the claim, indicating an elevated risk for the organization. Over the past 60 days, thegentlemen has claimed a substantial number of victims, totaling 248, with a significant concentration in the US, UK, and Germany. The inclusion of Servicios Aereos Estrella, a transportation entity based in Mexico, expands the group’s operational reach beyond its typical geographic focus. thegentlemen is characterized as a high-volume threat actor possessing the necessary infrastructure and established relationships with access brokers to target organizations across various countries and industries.

SOCRadar CTI’s analysis of the domain estrella[.]com[.]mx returned a “severe_exposure_in_sample” finding. This indicates that six employee credentials were found associated with Microsoft 365, admin portals, and Apple services, in addition to ten corporate third-party credentials. This extensive exposure across identity and vendor integration layers suggests a broad potential access surface for threat actors. The compromised credentials show activity spanning from February 19, 2026, to August 26, 2026, indicating multiple potential compromise windows over a six-month period. The close proximity of the credential exposure activity (ending August 26, 2026) to the ransomware group’s listing date (August 30, 2026) is a critical indicator of risk. It suggests that the compromised credentials may have been, or could still be, actively used for unauthorized access to Servicios Aereos Estrella’s systems, potentially facilitating ransomware deployment. For a transportation company, it is crucial to assess if any of the compromised systems or accounts have direct or indirect connections to critical operational infrastructure, such as fleet management or logistics platforms. For executive leadership, the convergence of a prolific ransomware operator, widespread credential exposure, and recent activity demands immediate attention. Key actions should include the prompt rotation of all identified credentials across all affected systems and third-party services, alongside a thorough review of authentication logs covering the period from February to August 2026 to identify any anomalous access patterns. A specific assessment should also be conducted to determine if any compromised accounts or systems pose a risk to operational technology or fleet management capabilities within the transportation sector.

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.