Global Airlines (Top 40) · Airline (Europe, legacy) · Data breach
Lufthansa
Headline
Lufthansa holds a seat on the board of ARC, the airline-owned clearinghouse that sold US travelers' domestic flight records - names, itineraries, financial information - to Customs and Border Protection under a…
Not independently verified. Verification status: Unverified - heuristic first draft. Publish state: draft unverified.
Lufthansa holds a seat on the board of ARC, the airline-owned clearinghouse that sold US travelers' domestic flight records - names, itineraries, financial information - to Customs and Border Protection under a contract that reportedly forbade CBP from revealing where the data came from. That is the sharpest finding attached to this row, and it is a governance finding rather than a breach: nobody was hacked, the data was sold, and the concealment of the source was written into the deal. Lufthansa Group separately notified passengers in November 2024 that accidentally published login details for a vendor's hotel-voucher tool had allowed unauthorized access, in January 2024, to cancelled-flight booking data from 2019-2024. The Lufthansa Group's shared data-protection framework also covers SWISS and Austrian Airlines, so a single group-level decision propagates across three carriers a passenger thinks of as distinct.
- Severity
- Evidence tierUnassigned
- Claims confirmed
- Last verified2026-08-04
Primary source. None recorded — Unverified - heuristic first draft.
Terms
Arbitration
Not independently confirmed this pass — GDPR applies as a Germany/EU-based carrier rather than a US-style arbitration clause.
Data sharing
CONFIRMED DATA INCIDENT (notified November 2024 under GDPR Art. 34): login details for an outside service provider's hotel-booking application — used to issue hotel vouchers to passengers whose flights were cancelled — were accidentally published, allowing unauthorized access in January 2024. Exposed fields covered bookings from November 2, 2019 to January 22, 2024: name, gender, mobile number, a travelling-with-toddler flag, the cancelled flight number, voucher number and hotel date; Lufthansa says payment details and email addresses were not visible. Lufthansa Group airlines notified affected passengers where email contacts were stored and informed data protection authorities. Note how long-retained records (five years of cancelled-flight bookings) remained exposed in a vendor tool.
Fees and billing
Not itemized this pass.
Contacts
Privacy contact. Not recorded.
Legal notice. Not verified this pass. If publicly traded: SEC Form 10-K cover page gives the official corporate address; the Secretary of State business-entity search in the state of incorporation gives the registered agent, which must accept service. If private: the state registered agent is usually the only reliable route.
Mailing address. Not recorded.
Evidence
No claims have been itemized for this row yet.
No sources are on file for this row yet.
Source vault
Link status: Candidate - not yet fetched
| Document | Last fetch | |
|---|---|---|
| Privacy policy lufthansa.com/us/en/privacy-policy | Not fetched yet | NO (HTML only) |
| Terms of service lufthansa.com/us/en/general-conditions-carriage | Not fetched yet | NO (HTML only) |
| Website No URL recorded | Not fetched yet | — |
| Primary source No URL recorded Verification: Unverified - heuristic first draft | Not fetched yet | — |
Enforcement
No enforcement actions are linked to this row.
State statute
No HQ state on file, so no state statute applies by headquarters.