Ransomware Gang Targets FlyDubai, Claiming Theft of Boeing Source Code in Cyber Insurance Threat

A recent cyberattack by the Everest ransomware group has elevated cybersecurity threats in the aviation sector to an unprecedented level. The extortionists listed United Arab Emirates carrier FlyDubai on their dark web leak site, initiating a six-day negotiation countdown timer. If FlyDubai refuses to pay, the hackers threaten to release a 4.36GB dataset.

The primary danger of this incident lies not in the exposure of personal records for 2,862 airline employees, but in the alleged theft of Boeing's proprietary intellectual property. The hackers claim to have exfiltrated 2,827 Java source code files for Boeing's Performance Engineers Tool (PET). This software is safety-critical, used by pilots and dispatchers to calculate takeoff weights, landing distances, fuel planning, and engine-out scenarios. More than 2,000 of the compromised files are reportedly marked as Boeing Proprietary, Confidential, and Trade Secret. Additionally, confidential CFM engine manuals and Airbus ETOPS guides are allegedly part of the stolen data.

For underwriters and actuaries, this case presents a highly complex precedent. A standard airline cyber insurance policy typically covers business interruption, notification costs, and crisis management. However, the exfiltration of third-party proprietary software code through a downstream operator's systems triggers multi-directional intellectual property liability chains that may fall into coverage gaps. Boeing could pursue claims against FlyDubai for failing to protect confidential materials under licensing agreements. Concurrently, third parties relying on PET calculations—such as other airlines, maintenance providers, and regulators—could file claims if the code is tampered with or its vulnerabilities are exploited.

Industry experts emphasize that such exposures often fall into a "gray zone" between traditional cyber insurance and technology errors and omissions (Tech E&O) policies. Most cyber policies do not contemplate third-party IP exfiltration as a covered trigger, while standard Tech E&O policies may exclude liabilities resulting from a cyber breach.

The Everest ransomware group is a major threat actor. It was previously responsible for the Collins Aerospace breach that disrupted European airports, an attack on Coca-Cola's Middle East distributor, and 2026 breaches of US-based Frost Bank and Citizens Bank.

Harriet Gruen, head of cyber threat intelligence at Howden Re, noted that as transport sectors become more connected, the visibility of cyber activity affecting operations will inevitably increase. This trend is already evident in maritime transport, where US authorities boarded two crude oil tankers in August 2026 following cyber incidents involving engine-room system manipulation.

For the insurance market in Kazakhstan and Central Asia, where regional carriers heavily rely on international software and place their reinsurance programs in global markets like Lloyd's, this incident is a critical warning. Brokers and risk managers must review policy terms before upcoming renewals to verify whether cyber policies cover third-party proprietary data exfiltration, whether business interruption extends through ransomware negotiations, and how cyber coverages align with Tech E&O policies.

Actuarial Takeaway: Intellectual property and proprietary code compromise across aviation supply chains creates cross-line accumulation risk across hull, liability, and cyber. Actuaries must incorporate widespread software recall and audit-induced grounding delays into systemic catastrophe modeling.