Tag Aviation

Tagaviation, also known as Tagaviation, is a business aviation company headquartered in Switzerland. The firm provides business aviation services to clients requiring private air travel solutions. Its operational footprint includes activities in Asian markets, as indicated by the impact of a recent cyber incident. Being based in Switzerland places the company within a jurisdiction known for strong privacy and aviation regulatory frameworks. The organisation serves a clientele that relies on on‑demand charter, aircraft management, and related aviation support. Tagaviation maintains operational links between its Swiss headquarters and its activities in Asia.

On May 21, 2023, Tagaviation became the target of a ransomware attack carried out by the Black Basta criminal group. The intrusion was first detected by the company’s intrusion detection system, which flagged an unauthorized network access attempt. The attackers proceeded to encrypt critical IT systems, disrupting normal business operations. The ransomware incident primarily affected the company’s Asian operations, leading to service interruptions in that region. During the breach, several terabytes of data were exfiltrated, encompassing scanned passports, internal corporate documents, and other sensitive information. The stolen data was later advertised for sale on a darknet blog by a third party, amplifying the potential misuse of the information. In response, Tagaviation engaged external cybersecurity experts and coordinated with law‑enforcement agencies to investigate the attack. The firm also undertook a comprehensive remediation effort, restoring affected systems and strengthening its security posture. As part of the post‑incident response, additional security measures were implemented to prevent similar intrusions in the future. The episode highlights the cybersecurity challenges faced by business aviation operators that manage large volumes of personal and operational data. Despite the disruption, the company has continued to operate its core aviation services while enhancing its defensive capabilities. The incident serves as a case study of how ransomware groups like Black Basta target specialised sectors with valuable data assets.