Envoy Air Hit With Class Suit Over Oracle ‘Hub and Spoke’ Breach

Former Envoy Air Employee Sues Over 2025 Data Breach Linked to CL0P Ransomware Group

A former Envoy Air Inc. employee has filed a class-action lawsuit against the regional airline and Oracle Corp., alleging negligence in protecting sensitive employee data exposed during a July 2025 cyberattack. The breach, attributed to the CL0P ransomware group, compromised personal information stored in Oracle’s business-software system, including Social Security numbers, birth dates, and financial account details.

Khianna Parks, the plaintiff, seeks to represent current and former Envoy Air employees affected by the incident. The complaint was filed on Wednesday in the U.S. District Court for the Western District of Texas. Envoy Air, a subsidiary of American Airlines Group Inc., has not yet publicly responded to the allegations.

The lawsuit highlights growing concerns over third-party vendor security risks and the persistent threat posed by ransomware groups targeting enterprise software systems. The breach underscores the potential long-term consequences of exposed personal data, including identity theft and financial fraud.

Source: https://news.bloomberglaw.com/privacy-and-data-security/envoy-air-hit-with-class-suit-over-oracle-hub-and-spoke-breach

Envoy Air cybersecurity rating report: https://www.rankiteo.com/company/envoyair

"id": "ENV1765565536",
"linkid": "envoyair",
"type": "Cyber Attack",
"date": "7/2025",
"severity": "85",
"impact": "3",
"explanation": "Attack with significant impact with internal employee data leaks"

{'affected_entities': [{'customers_affected': 'Current and former employees',
                        'industry': 'Aviation',
                        'location': 'United States',
                        'name': 'Envoy Air Inc.',
                        'type': 'Airline'},
                       {'industry': 'Software',
                        'location': 'United States',
                        'name': 'Oracle Corp.',
                        'type': 'Technology'}],
 'data_breach': {'personally_identifiable_information': 'Yes',
                 'sensitivity_of_data': 'High',
                 'type_of_data_compromised': ['Social Security numbers',
                                              'Birth dates',
                                              'Financial account information']},
 'date_detected': '2025-07',
 'description': 'A former Envoy Air Inc. employee sued the airline and Oracle '
                'Corp. for allegedly failing to protect personal information '
                'exposed in a July 2025 cyberattack that compromised workers’ '
                'data stored in Oracle’s business-software system. The CL0P '
                'cybercriminal group accessed personal information, including '
                'Social Security numbers, birth dates, and financial account '
                'information.',
 'impact': {'brand_reputation_impact': 'Likely negative',
            'data_compromised': 'Personal information (Social Security '
                                'numbers, birth dates, financial account '
                                'information)',
            'identity_theft_risk': 'High',
            'legal_liabilities': 'Lawsuit filed',
            'payment_information_risk': 'High',
            'systems_affected': 'Oracle’s business-software system'},
 'motivation': 'Financial Gain',
 'references': [{'source': 'Complaint filed in US District Court for the '
                           'Western District of Texas'}],
 'regulatory_compliance': {'legal_actions': 'Lawsuit filed in US District '
                                            'Court for the Western District of '
                                            'Texas'},
 'threat_actor': 'CL0P',
 'title': 'Envoy Air and Oracle Data Breach Lawsuit',
 'type': 'Data Breach'}