Global Airlines (Top 40) · Airline (Europe, legacy) · Data breach
SAS (Scandinavian Airlines)
Headline
SAS was swept up in the same 2021 SITA vendor breach as Finnair, Singapore Airlines, Japan Airlines and Air India - one intrusion at one aviation IT provider reaching frequent-flyer data across competing carriers on…
Not independently verified. Verification status: Unverified - heuristic first draft. Publish state: draft unverified.
SAS was swept up in the same 2021 SITA vendor breach as Finnair, Singapore Airlines, Japan Airlines and Air India - one intrusion at one aviation IT provider reaching frequent-flyer data across competing carriers on multiple continents. For a Scandinavian carrier operating under some of the world's more protective privacy expectations, the practical point is that GDPR governs what SAS may do with your data but does not determine the security of every alliance partner and vendor that data reaches. The strongest regulatory regime in the world is only as good as the weakest processor in the chain.
- Severity
- Evidence tierUnassigned
- Claims confirmed
- Last verified2026-08-04
Primary source. None recorded — Unverified - heuristic first draft.
Terms
Arbitration
Not independently confirmed this pass; as a Scandinavian carrier, GDPR applies via Sweden/Denmark/Norway's respective data protection authorities.
Data sharing
CONFIRMED PARTICIPANT in the SAME 2021 SITA multi-airline breach as Finnair/Singapore Airlines/Cathay Pacific/JAL (see those rows) — SAS was specifically named among the ~10 airlines whose frequent-flyer members were affected. SAS also went through CHAPTER 11 BANKRUPTCY restructuring (filed July 2022, exited in 2024 under a new ownership group in which Air France-KLM took a 19.9% stake alongside Castlelake, Lind Invest and the Danish state; in July 2025 Air France-KLM announced plans to raise its stake to 60.5%, with completion targeted for the second half of 2026 subject to regulatory approval (Euronews, July 4, 2025); completion not confirmed as of Oct 16, 2026) — a major operational/ownership change worth noting for any customer with historical SAS EuroBonus loyalty points or credits.
Fees and billing
Not itemized this pass.
Contacts
Privacy contact. Not recorded.
Legal notice. Not verified this pass. If publicly traded: SEC Form 10-K cover page gives the official corporate address; the Secretary of State business-entity search in the state of incorporation gives the registered agent, which must accept service. If private: the state registered agent is usually the only reliable route.
Mailing address. Not recorded.
Evidence
No claims have been itemized for this row yet.
No sources are on file for this row yet.
Source vault
Link status: Candidate - not yet fetched
| Document | Last fetch | |
|---|---|---|
| Privacy policy flysas.com/en/legal-notice/privacy-policy/ | Not fetched yet | NO (HTML only) |
| Terms of service flysas.com/en/legal-notice/conditions-of-carriage/ | Not fetched yet | NO (HTML only) |
| Website No URL recorded | Not fetched yet | — |
| Primary source No URL recorded Verification: Unverified - heuristic first draft | Not fetched yet | — |
Enforcement
No enforcement actions are linked to this row.
State statute
No HQ state on file, so no state statute applies by headquarters.