Global Airlines (Top 40) · Airline (Europe, legacy) · Data breach
KLM
Headline
KLM was hit by the same 2025 breach as Air France - the two share systems and a customer data environment, so a single intrusion reaches both.
Not independently verified. Verification status: Unverified - heuristic first draft. Publish state: draft unverified.
KLM was hit by the same 2025 breach as Air France - the two share systems and a customer data environment, so a single intrusion reaches both. That is the finding a passenger cannot see from the outside: booking with KLM rather than Air France feels like choosing a different company, and for data-exposure purposes it is not. Airline group structures consolidate customer data far more aggressively than the consumer-facing branding suggests, and no privacy policy makes the shared blast radius legible at the point of booking.
- Severity
- Evidence tierUnassigned
- Claims confirmed
- Last verified2026-08-04
Primary source. None recorded — Unverified - heuristic first draft.
Terms
Arbitration
Not independently confirmed this pass — GDPR/Dutch data protection law applies rather than a US-style arbitration clause.
Data sharing
SAME 2025 breach as Air France (see that row) — KLM and Air France share the same Air France-KLM Group parent and were breached through the same shared third-party customer-service platform. KLM specifically reported the incident to the Dutch Data Protection Authority and separately advised customers to watch for PHISHING attempts exploiting the stolen contact information.
Fees and billing
See the Air France row for the related US class action (voluntarily dismissed by the plaintiffs in Dec 2025), which available coverage describes as filed against Air France; whether KLM or the Air France-KLM Group was also named could not be confirmed.
Contacts
Privacy contact. Not recorded.
Legal notice. Not verified this pass. If publicly traded: SEC Form 10-K cover page gives the official corporate address; the Secretary of State business-entity search in the state of incorporation gives the registered agent, which must accept service. If private: the state registered agent is usually the only reliable route.
Mailing address. Not recorded.
Evidence
No claims have been itemized for this row yet.
No sources are on file for this row yet.
Source vault
Link status: Candidate - not yet fetched
| Document | Last fetch | |
|---|---|---|
| Privacy policy klm.com/travel/us_en/customer_services/privacy/index.htm | Not fetched yet | NO (HTML only) |
| Terms of service klm.com/travel/us_en/customer_services/general_conditions/index.htm | Not fetched yet | NO (HTML only) |
| Website No URL recorded | Not fetched yet | — |
| Primary source No URL recorded Verification: Unverified - heuristic first draft | Not fetched yet | — |
Enforcement
No enforcement actions are linked to this row.
State statute
No HQ state on file, so no state statute applies by headquarters.