STS Aviation Group, an aircraft maintenance, repair and overhaul provider, is notifying people that an unauthorized third party obtained their personal information in a cybersecurity incident. The notice lists Social Security numbers, passport numbers, medical and health insurance details and fingerprints among the data types involved.
STS Aviation Group’s Data Breach Investigation
STS Aviation Group is an aircraft maintenance provider. Its website describes nose-to-tail aircraft maintenance, repair and overhaul work, line maintenance, engineering support for airlines and manufacturers, and defense solutions for military operators. A company with that kind of global footprint employs a large technical workforce and holds detailed records about the people who work for it and with it.
According to a sample notice letter that STS Aviation Group filed with the California Attorney General, the company identified a cybersecurity incident on September 12, 2025. The letter says the incident involved unauthorized access to certain company systems, which occurred on or around August 5, 2025. The company says it began an investigation with outside cybersecurity experts to understand the nature and scope of the incident and to identify the people affected.
The letter says that, based on that investigation, the company determined on September 19, 2026 that an unauthorized third party obtained certain personal information in connection with the incident. The notice itself is dated October 19, 2026, the same day the filing appeared on the California Attorney General’s breach list. The letter does not explain why the determination came so long after the incident was first identified, and this page does not speculate about it.
STS Aviation Group says it blocked the unauthorized party’s access to its systems, took additional steps to enhance its safeguards and reported the matter to law enforcement. The notice does not say how the unauthorized party got in, whether the incident involved ransomware, whether the data was published, or whether any group has claimed responsibility. Those details have not been disclosed in the sources reviewed.
The notice does not state how many people were affected, and the California filing does not include a total. This page does not estimate one. The letter says the types of information varied by person, so being on the mailing list does not mean every category was exposed for every individual. The filing also does not say which groups of people received notice, such as current or former employees, job applicants, customers or contractors.
What stands out is the breadth of the data types the company listed. They include government identification documents and numbers, financial account data and medical and health insurance information, along with fingerprints, race and ethnicity and work-related records such as salary, evaluations and workers’ compensation claims. Biometric data such as fingerprints cannot be changed the way a password can, and a combination of identity numbers, financial details and employment records is useful to criminals who commit identity theft, tax fraud or targeted phishing.
The company says it has arranged for identity protection and credit monitoring through Experian for two years at no cost to recipients, and the letter gives an enrollment deadline of January 29, 2027. Recipients need the activation code printed in their own letter to enroll. The letter also provides a toll-free number for questions and asks callers to have their engagement number ready.
Anyone who receives this notice should keep it and act on the enrollment offer before the deadline. Other steps are covered below, but the most important point is that this notice describes confirmed access to personal information, not just a claim. The company’s own description, rather than outside speculation, is the best source for what happened to your information.
The company has not said whether any of the affected information has been misused. People who receive the notice should treat it seriously even though no misuse has been reported in the sources reviewed, because stolen identity data is often used long after an incident.
This page will be updated if the company or a regulator publishes more detail. A notice describing unauthorized access is not a finding about fault, and whether the company’s safeguards were adequate remains an open question. Those are the kinds of questions attorneys can ask on behalf of people who were harmed.
When Did This Breach Occur?
The company says the unauthorized access occurred on or around August 5, 2025 and that it identified the incident on September 12, 2025. It says it determined on September 19, 2026 that personal information was obtained, and the notice is dated October 19, 2026.
The notice’s own dates, as filed with the California Attorney General, are the basis for this timeline.
What Information Was Breached?
The company says the information varied by person and included name, contact information, date of birth, government identification documents and numbers such as Social Security, driver’s license and passport numbers, and financial account data such as payment card information.
It also included medical and health insurance information, fingerprints, race and ethnicity, and work-related information such as salary, evaluations and workers’ compensation claims. Not all categories were affected for every individual.
What You Can Do
If you received a notice related to STS Aviation Group or believe you may be affected, consider these steps:
- Read the notice carefully and keep it, along with any enrollment details for protection services it offers.
- Enroll in the two years of Experian identity protection and credit monitoring the notice offers before the January 29, 2027 deadline, using the activation code in your own letter. Because fingerprints and passport details may be involved, also consider an Identity Protection PIN from the IRS.
- Place a free fraud alert or a credit freeze with Equifax, Experian and TransUnion, and get your reports free at annualcreditreport.com.
- Review bank, card and insurance statements for anything you do not recognize.
- Be skeptical of unexpected calls, texts or emails that mention the incident, and report suspected identity theft to the Federal Trade Commission at identitytheft.gov.
File a Data Breach Lawsuit Against STS Aviation Group
If you received a notice that your personal information was exposed in the STS Aviation Group incident, you may have legal options. Companies are expected to safeguard the sensitive information entrusted to them, and a class action can help hold them accountable when they fail to do so.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
