Global Airlines (Top 40) · Airline (Asia, legacy) · Data breach
Air India (Tata Group)
Headline
Air India was part of the 2021 SITA breach, and its exposure is the most severe in that cluster: roughly 4.5 million passengers, with data including passport details and, for a subset, credit card information.
Air India was part of the 2021 SITA breach, and its exposure is the most severe in that cluster: roughly 4.5 million passengers, with data including passport details and, for a subset, credit card information. The exposed records covered bookings made over nearly a decade (Aug 2011 to Feb 2021). Air India was state-owned at the time and has since been privatised under the Tata Group, which creates a genuine accountability gap - the entity that made the security decisions and the entity a passenger would now pursue are not the same organisation, and the transfer of ownership did not transfer any practical remedy to the people whose passport numbers were taken.
- Severity
- Evidence tierUnassigned
- Claims confirmed
- Last verified2026-08-04
Primary source. therecord.media/air-india-says-data-breach-impacts-4-5-million-former-passengers — Verified - primary source confirmed.
Terms
Arbitration
Not independently confirmed this pass — India's Digital Personal Data Protection Act (DPDPA) applies domestically; GDPR applies for EU passengers.
Data sharing
CONFIRMED PARTICIPANT IN THE SAME 2021 SITA MULTI-AIRLINE BREACH as Singapore Airlines/Finnair/JAL (see those rows), but at a MUCH LARGER SCALE for Air India specifically: approximately 4.5 MILLION passengers' personal data was compromised, including passport and payment card details, spanning roughly 10 YEARS of accumulated passenger data (2011-2021). An individual passenger (Delhi journalist Ritika Handoo) sent Air India a legal notice in July 2021 - not a lawsuit - seeking Rs 30 lakh (roughly US$40,000) in compensation (outcome unknown), with her advocate invoking a 'right to be forgotten' and 'informational autonomy' framework — arguing that having personal data STOLEN (as opposed to merely collected) represents a total loss of control over one's own information.
Fees and billing
Not itemized this pass.
Contacts
Privacy contact. Not recorded.
Legal notice. Not verified this pass. If publicly traded: SEC Form 10-K cover page gives the official corporate address; the Secretary of State business-entity search in the state of incorporation gives the registered agent, which must accept service. If private: the state registered agent is usually the only reliable route.
Mailing address. Not recorded.
Evidence
| Claim | Kind | Support | Sources |
|---|---|---|---|
| 1. Air India was part of the 2021 SITA breach. | fact | supported | none recorded |
| 2. Air India's exposure was the most severe in the SITA cluster. | fact | unsupported | none recorded |
| 3. Roughly 4.5 million passengers were affected. | fact | supported | none recorded |
| 4. The data included passport details. | fact | supported | none recorded |
| 5. For a subset of passengers, the data included credit card information. | fact | unsupported | none recorded |
| 6. The exposed records covered bookings made over nearly a decade (Aug 2011 to Feb 2021). | fact | unsupported | 1 (0 confirmed) |
| 7. Air India was state-owned at the time. | fact | unsupported | none recorded |
| 8. Air India has since been privatised under the Tata Group. | fact | unsupported | none recorded |
| 9. The ownership change creates an accountability gap and transferred no practical remedy to affected passengers. | characterization | n/a | none recorded |
0 of 9 claims have a confirmed source of their own.
Sources
| Source | Claim | Tier | Status | Quote |
|---|---|---|---|---|
| none | Claim 6 | Unassigned | not found | No quote recorded. Quote basis: not recorded. |
Source vault
Link status: Candidate - not yet fetched
| Document | Last fetch | |
|---|---|---|
| Privacy policy airindia.com/in/en/important-information/privacy-policy.html | Not fetched yet | NO (HTML only) |
| Terms of service airindia.com/in/en/important-information/conditions-of-carriage.html | Not fetched yet | NO (HTML only) |
| Website No URL recorded | Not fetched yet | — |
| Primary source https://therecord.media/air-india-says-data-breach-impacts-4-5-million-former-passengers Verification: Verified - primary source confirmed | Not fetched yet | — |
Enforcement
No enforcement actions are linked to this row.
State statute
No HQ state on file, so no state statute applies by headquarters.