Global Airlines (Top 40) · Airline (Europe, legacy) · Data breach
Finnair
Headline
Finnair's exposure came through SITA, an aviation IT provider most passengers have never heard of that processes frequent-flyer data for a large share of the world's airlines.
Not independently verified. Verification status: Unverified - heuristic first draft. Publish state: draft unverified.
Finnair's exposure came through SITA, an aviation IT provider most passengers have never heard of that processes frequent-flyer data for a large share of the world's airlines. A single 2021 intrusion at SITA propagated simultaneously into Finnair, SAS, Singapore Airlines, Japan Airlines, Air India and others - carriers that compete with each other and that a privacy-conscious traveler might switch between for exactly this kind of reason, all sharing one point of failure. Star Alliance and oneworld membership means frequent-flyer data moves between carriers by design. Choosing a different airline did not diversify the risk; it was the same vendor either way.
- Severity
- Evidence tierUnassigned
- Claims confirmed
- Last verified2026-08-04
Primary source. None recorded — Unverified - heuristic first draft.
Terms
Arbitration
Not independently confirmed this pass — GDPR applies as a Finland/EU-based carrier.
Data sharing
CONFIRMED THIRD-PARTY VENDOR BREACH (2021, via SITA, a major global aviation IT services provider used by dozens of airlines): frequent-flyer program data was exposed as part of a broader SITA breach that also affected Singapore Airlines, Malaysia Airlines, Cathay Pacific, Lufthansa, United, Air India and other carriers simultaneously — Finnair confirmed this was NOT a breach of its own internal IT systems, and that the exposed data cannot be used to access Finnair Plus accounts directly since password data was not shared/exposed among the affected airlines. This illustrates how a single shared industry vendor (SITA, in this case handling frequent-flyer data-sharing BETWEEN partner airlines) can simultaneously expose multiple otherwise-unrelated carriers' loyalty program members.
Fees and billing
Not itemized this pass.
Contacts
Privacy contact. Not recorded.
Legal notice. Not verified this pass. If publicly traded: SEC Form 10-K cover page gives the official corporate address; the Secretary of State business-entity search in the state of incorporation gives the registered agent, which must accept service. If private: the state registered agent is usually the only reliable route.
Mailing address. Not recorded.
Evidence
No claims have been itemized for this row yet.
No sources are on file for this row yet.
Source vault
Link status: Candidate - not yet fetched
| Document | Last fetch | |
|---|---|---|
| Privacy policy finnair.com/us-en/privacy-policy | Not fetched yet | NO (HTML only) |
| Terms of service finnair.com/us-en/conditions-of-carriage | Not fetched yet | NO (HTML only) |
| Website No URL recorded | Not fetched yet | — |
| Primary source No URL recorded Verification: Unverified - heuristic first draft | Not fetched yet | — |
Enforcement
No enforcement actions are linked to this row.
State statute
No HQ state on file, so no state statute applies by headquarters.