Global Airlines (Top 40) · Airline (Europe, legacy) · Data breach
Swiss International Air Lines
Headline
SWISS self-disclosed a 2025 breach that was employee-facing rather than passenger-facing - worth recording precisely, because employee data breaches at airlines get far less scrutiny while exposing people who cannot…
Not independently verified. Verification status: Unverified - heuristic first draft. Publish state: draft unverified.
SWISS self-disclosed a 2025 breach that was employee-facing rather than passenger-facing - worth recording precisely, because employee data breaches at airlines get far less scrutiny while exposing people who cannot simply switch providers. SWISS operates under the Lufthansa Group's shared data-protection framework, so the governing decisions about how its data is handled are made at a parent level in a different country from the one whose flag is on the aircraft. Swiss data protection law, EU GDPR and the group's internal framework interact here in ways no passenger-facing document explains.
- Severity
- Evidence tierUnassigned
- Claims confirmed
- Last verified2026-08-04
Primary source. None recorded — Unverified - heuristic first draft.
Terms
Arbitration
SWISS is part of the LUFTHANSA GROUP (alongside Lufthansa, Austrian Airlines, Eurowings, and others), sharing a common 'Travel ID' data-protection framework across all Group airlines — GDPR applies via each airline's home-country data protection authority (Switzerland's DSG for SWISS specifically, since Switzerland is not EU but has its own comparable law).
Data sharing
CONFIRMED 2025 BREACH (self-disclosed, employee-facing): SWISS confirmed sensitive PILOT-APPLICANT ASSESSMENT data (application documents, test results and assessment reports of pilot candidates at SWISS, Edelweiss and the European Flight Academy) was left accessible for approximately TWO MONTHS due to an internal data-storage error (SWISS did not name the system; 'SharePoint' was not confirmed) — exposed internally to a large group of staff plus a limited circle of PARTNER COMPANY personnel who should not have had access. An employee, not SWISS's own monitoring systems, first reported the issue. SWISS states passenger data and other employees' data were NOT affected — this was specifically pilot-assessment records.
Fees and billing
Not itemized this pass.
Contacts
Privacy contact. Not recorded.
Legal notice. Not verified this pass. If publicly traded: SEC Form 10-K cover page gives the official corporate address; the Secretary of State business-entity search in the state of incorporation gives the registered agent, which must accept service. If private: the state registered agent is usually the only reliable route.
Mailing address. Not recorded.
Evidence
No claims have been itemized for this row yet.
No sources are on file for this row yet.
Source vault
Link status: Candidate - not yet fetched
| Document | Last fetch | |
|---|---|---|
| Privacy policy swiss.com/us/en/legal/privacy-policy | Not fetched yet | NO (HTML only) |
| Terms of service swiss.com/us/en/legal/terms-and-conditions | Not fetched yet | NO (HTML only) |
| Website No URL recorded | Not fetched yet | — |
| Primary source No URL recorded Verification: Unverified - heuristic first draft | Not fetched yet | — |
Enforcement
No enforcement actions are linked to this row.
State statute
No HQ state on file, so no state statute applies by headquarters.