Willis Lease Finance Corporation (WLFC) has recently filed a Form 8-K filing with the Securities and Exchange Commission (SEC) after falling prey to a cybersecurity incident they flagged on January 31, 2024, when unauthorized activity was first detected on portions of their system. WLFC is an engine and aircraft-parts dealer and service provider to major airlines. According to the company, the incident was fully contained on February 2nd and no unauthorized activity has since been detected. While WLFC officials have stated that they’re still working on the scope of the breach and whether any data was stolen and/or compromised, the Black Basta ransomware group claimed responsibility for the attack on February 9th, adding the company to their leak site. The threat actor claims to have stolen upwards of 900 GB of sensitive company information, including confidential documents, non-disclosure agreements (NDAs), employee and customer information, shared folders, and more. Sample documents posted online by the ransomware gang includes leasing agreements between WLFC and various major airlines, along with SSNs and passport scans belonging to what appears to be company staff. WLFC took steps to contain, assess, and remediate the initial activity, including taking some systems offline. CTIX analysts will continue to monitor the operations of both state-sponsored and financially-motivated threat actors alike.