Global Airlines (Top 40) · Airline (Europe, legacy) · Data breach
Air France
Headline
Air France sits on the board of ARC, the carrier-owned clearinghouse that sold US travelers' flight records to Customs and Border Protection under a contract that reportedly prohibited CBP from disclosing the source.
Not independently verified. Verification status: Unverified - heuristic first draft. Publish state: draft unverified.
Air France sits on the board of ARC, the carrier-owned clearinghouse that sold US travelers' flight records to Customs and Border Protection under a contract that reportedly prohibited CBP from disclosing the source. Separately, Air France confirmed a 2025 breach that was part of a much larger cross-industry attack campaign - the same social-engineering wave running through dozens of rows across this tracker. Two different exposure mechanisms in one company: one where criminals took the data, and one where the industry sold it and contracted for silence about having done so.
- Severity
- Evidence tierUnassigned
- Claims confirmed
- Last verified2026-08-04
Primary source. None recorded — Unverified - heuristic first draft.
Terms
Arbitration
Not independently confirmed this pass — as a French/EU carrier, GDPR applies rather than a US-style consumer arbitration clause.
Data sharing
CONFIRMED 2025 BREACH, part of a MAJOR CROSS-INDUSTRY ATTACK CAMPAIGN: hackers (linked to the ShinyHunters extortion group, using voice-phishing/social-engineering against customer-support staff) accessed a THIRD-PARTY customer-service platform (widely reported to be Salesforce-based) shared with sister airline KLM, exposing names, phone numbers, emails, Flying Blue loyalty numbers/status, and support-ticket subject lines for an undisclosed number of customers — the airlines state passwords, travel details, Flying Blue MILES, and passport/credit card data were NOT affected. Notified French (CNIL) and Dutch data protection authorities. This was part of a much broader 2025 wave using the same attack technique against Google, Chanel, Louis Vuitton, Dior, Tiffany & Co., Adidas, Allianz Life, LVMH, and Pandora — illustrating how one vulnerable THIRD-PARTY CRM platform can cascade into dozens of otherwise-unrelated companies' breaches simultaneously.
Fees and billing
US CLASS ACTION, SINCE VOLUNTARILY DISMISSED (Allison & Soofiani v. Air France, S.D.N.Y., filed 2025; plaintiffs filed a notice of voluntary dismissal around Dec 1, 2025): alleges Air France failed to implement 'reasonable cybersecurity safeguards,' failed to adequately train IT/security staff, and that the complimentary credit-monitoring offered to affected customers doesn't 'adequately address the lifelong harm' from the breach. Note one commenter on the coverage pointed out that TWO named plaintiffs alone does not constitute a certified US-style class action — the case still needs class certification to proceed as a broader group claim.
Contacts
Privacy contact. Not recorded.
Legal notice. Not verified this pass. If publicly traded: SEC Form 10-K cover page gives the official corporate address; the Secretary of State business-entity search in the state of incorporation gives the registered agent, which must accept service. If private: the state registered agent is usually the only reliable route.
Mailing address. Not recorded.
Evidence
No claims have been itemized for this row yet.
No sources are on file for this row yet.
Source vault
Link status: Candidate - not yet fetched
| Document | Last fetch | |
|---|---|---|
| Privacy policy wwws.airfrance.us/legal/privacy-policy | Not fetched yet | NO (HTML only) |
| Terms of service wwws.airfrance.us/legal/general-conditions-of-carriage | Not fetched yet | NO (HTML only) |
| Website No URL recorded | Not fetched yet | — |
| Primary source No URL recorded Verification: Unverified - heuristic first draft | Not fetched yet | — |
Enforcement
No enforcement actions are linked to this row.
State statute
No HQ state on file, so no state statute applies by headquarters.