Global Airlines (Top 40) · Airline (Asia, LCC) · Data breach
AirAsia
Headline
The 2022 AirAsia breach was disclosed through the breach-news site DataBreaches.net, to which the attackers sent samples, rather than by AirAsia, and the ransomware group involved made a point of publicly criticising…
Not independently verified. Verification status: Unverified - heuristic first draft. Publish state: draft unverified.
The 2022 AirAsia breach was disclosed through the breach-news site DataBreaches.net, to which the attackers sent samples, rather than by AirAsia, and the ransomware group involved made a point of publicly criticising the state of AirAsia's internal network. That inversion is the finding: passengers learned from third parties, and the most detailed public account of a carrier's security posture came from the people who broke into it. When disclosure is driven by researchers and attackers rather than by the company, passengers lose the one thing that actually helps them - early, accurate notice while there is still time to act.
- Severity
- Evidence tierUnassigned
- Claims confirmed
- Last verified2026-08-04
Primary source. None recorded — Unverified - heuristic first draft.
Terms
Arbitration
Not independently confirmed this pass; Malaysia's Personal Data Protection Act applies domestically.
Data sharing
REPORTED BREACH (2022): the Daixin Team ransomware group claimed a November 2022 attack on AirAsia and said it took personal data of all employees and up to 5 million unique passengers; these are the attackers' claims as reported (The Hacker News, Nov. 21, 2022; no AirAsia statement was found), although Malaysia's communications minister said in December 2022 that preliminary investigations pointed to unauthorised access that caused a ransomware attack.
Fees and billing
Not itemized this pass.
Contacts
Privacy contact. Not recorded.
Legal notice. Not verified this pass. If publicly traded: SEC Form 10-K cover page gives the official corporate address; the Secretary of State business-entity search in the state of incorporation gives the registered agent, which must accept service. If private: the state registered agent is usually the only reliable route.
Mailing address. Not recorded.
Evidence
No claims have been itemized for this row yet.
No sources are on file for this row yet.
Source vault
Link status: Candidate - not yet fetched
| Document | Last fetch | |
|---|---|---|
| Privacy policy airasia.com/privacy-policy | Not fetched yet | NO (HTML only) |
| Terms of service airasia.com/terms-and-conditions | Not fetched yet | NO (HTML only) |
| Website No URL recorded | Not fetched yet | — |
| Primary source No URL recorded Verification: Unverified - heuristic first draft | Not fetched yet | — |
Enforcement
No enforcement actions are linked to this row.
State statute
No HQ state on file, so no state statute applies by headquarters.