Update-2: ICAO statement on reported security incident

ICAO is actively investigating an information security incident allegedly linked to a threat actor known for targeting international organizations. 

ICAO has confirmed that the reported information security incident involves approximately 42,000 recruitment application data records from April 2016 to July 2024 claimed to be released by the threat actor known as Natohub. 

After completing careful review of the data, ICAO can now confirm that 11,929 individuals are affected. ICAO is now reaching out to these individuals. Support is being provided through a dedicated mailbox, which can be reached at mydata [at] icao.int (mydata[at]icao[dot]int) . 

The compromised data includes recruitment-related information that applicants entered into our system, such as names, email addresses, dates of birth, and employment history. The affected data does not include banking information, passwords, passport details, or any documents uploaded by applicants.

We can confirm that this incident is limited to the recruitment database and does not affect any systems related to aviation safety or security operations. 

Our investigation and response efforts continue, and we have implemented additional security measures to protect our systems. 

ICAO takes the privacy and security of personal information extremely seriously. We will provide further updates as our investigation progresses..

Media inquiries should be directed to: media.relations [at] icao.int (media[dot]relations[at]icao[dot]int).

Updated 16:30 UTC -5 on 10 January 2025