Cirrus Aircraft experienced a data security incident on July 17, 2026, resulting from a social engineering attack that caused unauthorized disclosure of sensitive files to a third party. The aviation manufacturer launched an investigation with external cybersecurity and forensic specialists to secure internal systems and evaluate the scope of the exposed records. State regulatory disclosures followed in November 2026, including filings submitted to attorney general offices in Texas, Massachusetts, and Vermont.
The compromised records included personal, financial, and health-related details. Exposed data elements consisted of names, postal addresses, Social Security numbers, driver's license numbers, other government-issued identification numbers, bank account numbers, credit or debit card numbers, medical information, and account login credentials. While individual state filings documented 280 affected residents in Texas and 4 in Vermont, a complete nationwide total of affected individuals has not been publicly released.
Consumer notification letters providing credit monitoring services were issued in November 2026. Because state reporting requirements vary and forensic reviews frequently continue after initial filings, total impact numbers and additional state-level disclosures may expand over time.