British Airways
The 2018 breach is the most-studied GDPR case in aviation because of what the regulator found: attackers reached BA's systems and harvested payment card…
Unassigned
Companies
Company records matching your filters, worst first. Rows marked unverified have not been checked against a primary source.
Results
Qantas
Qantas was ordered by Australia's Federal Court to pay A$100 million in October 2024 for selling tickets on flights it had already decided to cancel.
Unassigned
Air India (Tata Group)
Air India was part of the 2021 SITA breach, and its exposure is the most severe in that cluster: roughly 4.5 million passengers, with data including passport…
Unassigned
Cathay Pacific
Cathay is the most thoroughly documented airline breach in this tab, and the timeline is why: attackers had access from roughly October 2014, Cathay detected…
Unassigned
TAP Air Portugal
The Ragnar Locker ransomware crew took data tied to more than 5 million unique email addresses from a state-owned flag carrier in 2022 and published it when…
Unassigned
Air Canada
Two findings, and the second is the one with legs.
Unassigned
Air France
Air France sits on the board of ARC, the carrier-owned clearinghouse that sold US travelers' flight records to Customs and Border Protection under a contract…
Unassigned
AirAsia
The 2022 AirAsia breach was disclosed through the breach-news site DataBreaches.net, to which the attackers sent samples, rather than by AirAsia, and the…
Unassigned
Austrian Airlines
There is no Austrian Airlines-specific finding this pass, and the reason is itself the finding: Austrian is a Lufthansa Group airline, and group-wide systems…
Unassigned
Emirates
Italy's Garante fined Emirates €180,000 in June 2026 - a real enforcement action, and a useful illustration of how little leverage a national regulator has…
Unassigned
Finnair
Finnair's exposure came through SITA, an aviation IT provider most passengers have never heard of that processes frequent-flyer data for a large share of the…
Unassigned
Frontier Airlines
Frontier disclosed a breach to the Vermont Attorney General on July 9, 2026 - very recent, and the disclosure route is the notable part.
Unassigned
Iberia (IAG)
Iberia notified customers in November 2025 of unauthorized access to a supplier's systems exposing names, email addresses and Iberia Club loyalty IDs, days…
Unassigned
IndiGo
No IndiGo customer-data breach confirmed this pass, but IndiGo disclosed on December 31, 2020 that some of its servers had been hacked earlier that month and…
Unassigned
Japan Airlines (JAL)
JAL was part of the 2021 SITA multi-airline breach that also reached Finnair, SAS, Singapore Airlines and Air India.
Unassigned
KLM
KLM was hit by the same 2025 breach as Air France - the two share systems and a customer data environment, so a single intrusion reaches both.
Unassigned
LATAM Airlines
No source could be located for the 2020 breach (resurfacing in 2022) attributed to LATAM in an earlier draft, so it is not asserted here.
Unassigned
Lufthansa
Lufthansa holds a seat on the board of ARC, the airline-owned clearinghouse that sold US travelers' domestic flight records - names, itineraries, financial…
Unassigned
Ryanair
Ryanair's facial-recognition verification requirement is the finding: passengers who book through third-party travel agents have been pushed to submit a…
Unassigned
SAS (Scandinavian Airlines)
SAS was swept up in the same 2021 SITA vendor breach as Finnair, Singapore Airlines, Japan Airlines and Air India - one intrusion at one aviation IT provider…
Unassigned
Singapore Airlines
Singapore Airlines was caught in the 2021 SITA vendor breach alongside Finnair, SAS, Japan Airlines and Air India - frequent-flyer data for KrisFlyer members…
Unassigned
Spirit Airlines
Spirit ceased all flight operations on May 2, 2026 and is being liquidated; the analysis below describes its fare model while it operated.
Unassigned
Swiss International Air Lines
SWISS self-disclosed a 2025 breach that was employee-facing rather than passenger-facing - worth recording precisely, because employee data breaches at…
Unassigned
Wizz Air
The claimed 2025 breach has never been independently confirmed by Wizz Air, and that is the honest state of this row - an attacker assertion, not an…
Unassigned
easyJet
Roughly nine million customers had data exposed, including credit card details for a subset, and the group claim that followed asserted potential damages of…
Unassigned
ANA (All Nippon Airways)
Nothing confirmed
Unassigned
Aeroflot
The 2025 cyberattack on Russia's flag carrier (July 28, 2025) was claimed by hacktivist groups Silent Crow and Belarus Cyber-Partisans, who said they had a…
Unassigned
Air China
Nothing confirmed
Unassigned
Alaska Airlines
Alaska sits on the ARC board - the airline-owned clearinghouse that sold US travelers' domestic flight records, including names, itineraries and financial…
Unassigned
China Eastern Airlines
Nothing confirmed
Unassigned
China Southern Airlines
Nothing confirmed
Unassigned
Copa Airlines
Nothing confirmed
Unassigned
Etihad Airways
Nothing confirmed
Unassigned
JetBlue
JetBlue holds an ARC board seat, placing it inside the arrangement that sold passenger flight records to Customs and Border Protection under a…
Unassigned
Korean Air
Nothing confirmed
Unassigned
Qatar Airways
Nothing confirmed
Unassigned
Saudia (Saudi Arabian Airlines)
Nothing confirmed
Unassigned
Turkish Airlines
Nothing confirmed
Unassigned
Vietnam Airlines
Nothing confirmed
Unassigned
Virgin Atlantic
Nothing confirmed
Unassigned
Try fewer filters, or clear them all.