HackingTransportation & LogisticsTransportationVulnerability ExploitSupply Chain (3P Vendor)Data ExfiltratedCustomer Data InvolvedGovernment IDFinancial accountMediumActive

Aero Charter, Inc.

bd_341e008ae7a8f1a2 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Dec 6, 2020

Filed

Mar 1, 2021

To disclose

12 weeks

Affected

1state residents only

Linked

2 filings

Confidence

66%

Full breach record for Aero Charter, Inc. →2 incidents on file

Aero Charter, Inc. notified the NH Attorney General that its software provider, Avianis Systems, LLC, suffered a data breach on December 6, 2020. An intruder exploited a vulnerability in a Microsoft Azure Cloud file storage container configuration to illegally download document files. The breach affected one New Hampshire resident. Compromised data included passport information, state-issued ID, federal pilot license, driver’s license, and payment card information. Avianis contained the incident within 24 hours and is working with forensic investigators and law enforcement. Aero Charter is offering 12 months of complimentary identity theft protection.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 12 weeks / 85 days

Dec 6, 2020

Begins

Dec 6, 2020

Discovered

Mar 1, 2021

Filed

This filing is one of 2 filings about the same incident.View merged incident

Part of Avianis supply-chain incident (2021) — a supply-chain cascade affecting multiple organizations.View cascade →

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Indiana State AGbd_5edde02f6a5cb5a22021-03-01Verified

Name: Aero Charter, Inc.
norm: aero charter

Name: Aero Charter, Inc.
norm: aero charter
Industry: Transportation & Logisticsllm

Discovered: Dec 6, 2020
Breach occurred: Dec 6, 2020
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Mar 1, 2021
Affected individuals: 1state-resident count only
Data types: Government IDFinancial account
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: External
Regulator citations: Notified NH Department of Justice
Third party: via Avianis Systems, LLC
Initial access: exploit_public_facing

During the incident: Working closely with Avianis to understand the scope of the incident
Avianis notified law enforcement of the incident
Avianis working with a forensic investigation team
Offering 12 months of complimentary identity theft protection services through Equifax ID Patrol
Changes made: Avianis has taken steps to reduce the likelihood of other attacks
Aero Charter has implemented new procedures to reduce the likelihood or impact of future attacks
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 12 weeks(85 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Indiana State AGMar 1 · first

New Hampshire State AGMar 1 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/aero-charter-avianis-systems-20210301.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 1, 2021
Raw hash: 50e3e5e4518b993a7407d19efe5e6409fa7e06ceb6630e8ec8cde4accd2351b9

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityAero Charter, Inc.

Victim entityAero Charter, Inc.

Incidentdiscovered Dec 6, 2020

Stated responseWorking closely with Avianis to understand the scope of the incident

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov