Cirrus Aircraft Discloses July 17 Data Breach Exposing Personal, Financial and Medical Information
Why It MattersAircraft makers hold buyer identity, payment and medical records that make them targets for social engineering, and a months-long gap between intrusion and regulator notice shows how slowly such exposure surfaces.
What happened
Cirrus Aircraft, a personal aviation company headquartered in Duluth, Minnesota, has disclosed a data breach stemming from a social engineering event that targeted the company on July 17, 2026. Cirrus notified the attorneys general of Massachusetts and Texas on Nov. 10, 2026. So far, 280 Texas residents have been identified as affected.
After becoming aware of the incident, Cirrus launched an investigation and data analysis to determine what happened and what data may have been involved. The company determined that the exposed information included names, addresses, Social Security numbers, driver's license numbers, and government-issued ID numbers such as passports or state ID cards. Financial information, such as account numbers or credit and debit card numbers, and medical information were also exposed.
Cirrus is offering affected individuals a complimentary 24-month membership in Epiq Universal Credit Monitoring. Recipients can enroll through Epiq Monitoring Solutions using the activation code included in their notification letter, and can call Epiq at 866-675-2006 with questions about enrollment. The company has also set up a dedicated toll-free call center at 888-650-4420 for questions about the incident.
Industry impact & what to watch
A manufacturer that sells aircraft directly to individual owners accumulates the kind of records that identity thieves value: government ID numbers, payment details and, in some cases, health information tied to pilot qualification or medical clearance. Social engineering aims at employees rather than systems, so spending on perimeter security does little against it. Aircraft sales, financing and delivery workflows all involve staff routinely sending sensitive documents to outside parties, which is where this style of attack tends to work.
The timeline also shows how this kind of exposure surfaces. The social engineering event dates to July 17, and the regulator notices went out on Nov. 10, a gap of nearly four months between the incident and public disclosure. Over that stretch, the investigation and data analysis had to establish which individuals and which categories of data were involved before notification letters could be prepared.
The Texas count of 280 is the only per-state figure identified so far. Totals in the other jurisdictions, including Massachusetts, would be the next numbers to settle how widely the exposure reaches, and any further regulator filings would be where they appear.
