An unauthorized third party broke into STS Aviation Group’s systems in August 2025 and obtained personal information, including fingerprints and Social Security numbers. STS did not mail notice letters until October 19, 2026, more than 14 months later.
How the STS Aviation Group Breach Happened
STS Aviation Group is an aircraft maintenance, repair and overhaul (MRO) and technical staffing company based in Jensen Beach, Florida.
According to the company’s Notice of Data Breach, the unauthorized access happened on or around August 5, 2025. STS identified the cybersecurity incident on September 12, 2025. The company says it brought in outside cybersecurity experts, blocked the intruder’s access, strengthened its safeguards and reported the matter to law enforcement.
STS says it determined on September 19, 2026 that the unauthorized third party obtained personal information. The company dated its notice letters October 19, 2026, and filed a sample letter with the California Attorney General the same day.
The letter does not say that anyone has misused the information or name who was behind the attack.
Why the 14-Month Delay Matters
STS sent notice about 440 days after the break-in and about 13 months after it first spotted the incident. The letter says the investigation set out to learn what personal information was affected and who was involved. It does not explain why that review took more than a year.
During that time, affected individuals had no warning to freeze their credit or watch their accounts.
This is also not the first reported incident at STS. In a June 2024 filing with the Maine Attorney General, STS reported an earlier breach from November 2023 that affected 2,810 people.
STS has not disclosed how many people were affected by the August 2025 incident. Its California filing does not list a total.
What Information Was Exposed?
Based on the official notice, the information involved varied by person. Not every category was affected for every individual. The categories include:
- Names
- Contact information (phone numbers, email and postal addresses)
- Dates of birth
- Government ID documents and numbers, such as Social Security, driver’s license and passport numbers
- Financial account data, such as payment card information
- Medical and health insurance information
- Fingerprints
- Race and ethnicity
- Work-related information, such as salary, evaluations and workers’ compensation claims
The salary, evaluation and workers’ compensation details suggest that many people affected are current or former STS workers. The letter itself does not say who received it.
What Is STS Aviation Group Offering Affected Individuals?
STS is offering two years of free Experian IdentityWorks credit monitoring and identity protection. Enrollment requires the activation code printed in each letter. The deadline to enroll is January 29, 2027.
Questions go to Experian’s call center at 833-918-7674, Monday through Friday, 8 a.m. to 8 p.m. Central Time. Callers should have the engagement number from their letter ready.
Why Fingerprints and Workers’ Comp Records Raise the Stakes
A person can replace a card number or a password. Fingerprints are biometric data, meaning information taken from the body, and they cannot be replaced.
This breach also pairs Social Security, driver’s license and passport numbers with dates of birth and contact details. Criminals can use that mix to open accounts, file fake tax returns or pass identity checks. Medical, health insurance and workers’ compensation records add a risk of medical identity theft, which is when someone uses another person’s identity to get care or file insurance claims.
Affected individuals should:
- Enroll in the free Experian monitoring before January 29, 2027
- Place a free credit freeze with Equifax, Experian and TransUnion
- Review bank, card and health insurance statements for charges they do not recognize
- Watch for phishing emails, texts or calls that mention STS or the breach
Do You Have Legal Options?
Employers and staffing companies that collect workers’ Social Security numbers, health records and fingerprints have a legal duty to protect that information. When a company does not meet that duty, affected individuals may have legal rights and remedies.
Contact the Data Breach Attorneys at Emery | Reddy today for a Free Case Review.
Your Personally Identifiable Information (PII) includes information that can be used to identify you, such as your name and other personal details. Organizations that manage healthcare data are legally required to safeguard this information. When PII is exposed in a data breach, it can potentially be used by cybercriminals to commit identity theft, financial fraud, or other misuse.
Residents of California may be entitled to additional protections under the California Consumer Privacy Act (CCPA), which provides enhanced rights regarding the collection, use, and safeguarding of personal information.
FAQ
How many people were affected by the STS Aviation Group data breach?
STS has not disclosed a total. Its California Attorney General filing does not list a number of people affected.
What information was exposed in the breach?
It depends on the person. According to the notice, the information may include:
- Name, contact information and date of birth
- Social Security, driver’s license and passport numbers
- Payment card and other financial account data
- Medical and health insurance information
- Fingerprints
- Race and ethnicity
- Salary, evaluations and workers’ compensation claims
Why did it take so long for STS to notify people?
The break-in happened around August 5, 2025, and STS spotted it on September 12, 2025. STS says it confirmed on September 19, 2026 that personal information was obtained. Letters went out October 19, 2026. STS has not explained why its review took more than a year.
Is this the same as the earlier STS Aviation Group breach?
No. STS reported a separate incident from November 2023 to the Maine Attorney General in June 2024. The notice letters dated October 19, 2026 cover the August 2025 incident.
What should I do if I received a notification letter?
- Enroll in Experian IdentityWorks using the code in your letter before January 29, 2027
- Freeze your credit with all three credit bureaus
- Check your bank, card and insurance statements
Can stolen fingerprints be misused?
Your fingerprints cannot be changed the way a password can. If they are copied, they could be used to try to get past fingerprint-based security. Ask any service that relies on your fingerprint whether it offers a second way to verify your identity.
How do I avoid scams that mention the breach?
Criminals often send fake messages that name a recent breach. Do not click links in them. Contact the company using a phone number you trust.
Do I have a legal claim?
Companies that collect your personal information have a duty to protect it and to tell you promptly when it is exposed. If you received a letter from STS Aviation Group, you may have rights. Contact Emery | Reddy at 916.995.5968 or visit emeryreddy.com for a Free Case Review to see what you may qualify for. No Fee Unless We Recover.
