American Airlines Subsidiary Envoy Air Hit by Oracle Hack

Envoy Air, which operates the American Eagle brand for American Airlines, has confirmed it was impacted by the Oracle E-Business Suite campaign, with the attackers claiming a leak of more than 26 GB of archive data. The hackers have listed American Airlines on the Cl0p ransom site, and the operation has been linked to a group known as FIN11, though SecurityWeek notes the precise attribution is not fully clear.

Envoy says the investigation found that customer or other sensitive data was not compromised, but admits that a limited amount of business information and commercial contact details may have been affected. At the time of writing, Harvard University was cited as the first confirmed victim of the Oracle EBS hack, with several other organisations subsequently named on the Cl0p site.

Envoy Air describes itself as the largest regional carrier for American Airlines, with over 800 daily flights to more than 160 destinations under the American Eagle brand. This update was reported on 20 October 2025, according to SecurityWeek.