BianLian, a ransomware group that has been active since June 2022 and commonly targets critical infrastructure organizations throughout the United States and Australia, has claimed to have exfiltrated 210 gigabytes (GB) of data following the recent Air Canada cyberattack. Air Canada is Canada’s largest airline who disclosed a data breach in mid-September 2023 and stated that “an unauthorized group briefly obtained limited access to the internal Air Canada system related to limited personal information of some employees and certain records.” The airline also confirmed in their statement that no customer information was accessed during the cyberattack. BianLian, however, is alleging that it exfiltrated the following information from Air Canada: personal information of employees, data regarding vendors and suppliers, confidential documents, SQL backups, archives from company databases, and technical and operational information spanning from 2008 to 2023, which includes details about the company’s technical and security challenges. The threat group has also shared screenshots of potentially stolen data on their dark web data leak website. Air Canada has responded to these claims by stating they are aware of the extortion threats, but the airline did not confirm BianLian’s claims of being behind the September cyberattack. Air Canada has yet to release details of when the attack was detected, when its network was breached, and how many individuals were impacted by the incident. CTIX analysts will continue to monitor the cyber incident surrounding Air Canada and provide updates when available.