Global Airlines (Top 40) · Airline (Europe, legacy) · Regulatory action + Data breach
Iberia (IAG)
Headline
Iberia notified customers in November 2025 of unauthorized access to a supplier's systems exposing names, email addresses and Iberia Club loyalty IDs, days after a threat actor was reported offering purported Iberia…
Not independently verified. Verification status: Unverified - heuristic first draft. Publish state: draft unverified.
Iberia notified customers in November 2025 of unauthorized access to a supplier's systems exposing names, email addresses and Iberia Club loyalty IDs, days after a threat actor was reported offering purported Iberia internal data for $150,000. Iberia sits inside International Airlines Group alongside British Airways, so the group that produced aviation's most-studied GDPR enforcement case was running a second carrier that took months to surface its own incident. The recurring pattern across this tab is that regulatory penalties land on one brand while the underlying group practices continue elsewhere under a different name.
- Severity
- Evidence tierUnassigned
- Claims confirmed
- Last verified2026-08-04
Primary source. None recorded — Unverified - heuristic first draft.
Terms
Arbitration
Not independently confirmed this pass — GDPR applies as a Spanish/EU carrier (part of IAG, alongside British Airways and Vueling) rather than a US-style consumer arbitration clause.
Data sharing
CONFIRMED SUPPLIER BREACH (customers notified ~Nov 23, 2025): unauthorized access to an Iberia supplier's systems exposed names, email addresses and Iberia Club loyalty IDs (Iberia says no account passwords or financial data were affected). Separately, on Nov 14, 2025 a threat actor was reported offering 77 GB of purported Iberia internal data (aircraft technical/maintenance files) for $150,000 — not confirmed as connected to the supplier breach. SEPARATELY, prior research reported that GDPR case-law compilations list Iberia (part of IAG, the same parent group as British Airways — see that row) among EU airlines cited over subject-access-request and right-to-erasure handling; no specific regulator decision finding Iberia in breach of those rights was located this pass.
Fees and billing
Not itemized this pass.
Contacts
Privacy contact. Not recorded.
Legal notice. Not verified this pass. If publicly traded: SEC Form 10-K cover page gives the official corporate address; the Secretary of State business-entity search in the state of incorporation gives the registered agent, which must accept service. If private: the state registered agent is usually the only reliable route.
Mailing address. Not recorded.
Evidence
No claims have been itemized for this row yet.
No sources are on file for this row yet.
Source vault
Link status: Candidate - not yet fetched
| Document | Last fetch | |
|---|---|---|
| Privacy policy iberia.com/us/privacy-policy/ | Not fetched yet | NO (HTML only) |
| Terms of service iberia.com/us/legal-notice/ | Not fetched yet | NO (HTML only) |
| Website No URL recorded | Not fetched yet | — |
| Primary source No URL recorded Verification: Unverified - heuristic first draft | Not fetched yet | — |
Enforcement
No enforcement actions are linked to this row.
State statute
No HQ state on file, so no state statute applies by headquarters.