Global Airlines (Top 40) · Airline (Europe, legacy) · Data breach
TAP Air Portugal
Headline
The Ragnar Locker ransomware crew took data tied to more than 5 million unique email addresses from a state-owned flag carrier in 2022 and published it when TAP refused to pay.
The Ragnar Locker ransomware crew took data tied to more than 5 million unique email addresses from a state-owned flag carrier in 2022 and published it when TAP refused to pay. That refusal is defensible policy - paying funds the next attack - but it also means the harm was transferred wholesale onto passengers, who had no vote in the decision and received a published dataset rather than a quietly ransomed one. Nothing in a ticket contract gives a passenger any say in how their carrier responds to an extortion demand, though the response determines whether their data ends up public.
- Severity
- Evidence tierUnassigned
- Claims confirmed
- Last verified2026-08-04
Primary source. haveibeenpwned.com/Breach/TAPAirPortugal — Verified - primary source confirmed.
Terms
Arbitration
Not independently confirmed this pass — as a Portuguese/EU carrier, GDPR applies (requiring notification to Portugal's CNPD data protection authority for any confirmed breach) rather than a US-style consumer arbitration clause.
Data sharing
CONFIRMED 2022 RANSOMWARE BREACH (Ragnar Locker gang): exposed OVER 5 MILLION unique email addresses plus names, genders, birthdates, phone numbers, and physical addresses — the gang publicly leaked the data via a dark-web site after 'naming and shaming' the airline. A SEPARATE extortion claim was made in July 2023 by the GhostSec group, which claimed to have exfiltrated 350GB of TAP data and demanded a $250,000 ransom within one week (reported by The Cyber Express, July 4, 2023; the attackers' claim was not confirmed by TAP). MOST RECENTLY (reportedly May 2026), a NEW, separate, UNCONFIRMED breach claim was reportedly posted on a hacker forum (the post itself was not retrieved this pass) alleging a fresh customer-database exfiltration including passport details and payment information — not independently verified by TAP as of this research, following the same 'claimed but unconfirmed' pattern seen for Wizz Air elsewhere in this tab.
Fees and billing
Not itemized this pass.
Contacts
Privacy contact. Not recorded.
Legal notice. Not verified this pass. If publicly traded: SEC Form 10-K cover page gives the official corporate address; the Secretary of State business-entity search in the state of incorporation gives the registered agent, which must accept service. If private: the state registered agent is usually the only reliable route.
Mailing address. Not recorded.
Evidence
| Claim | Kind | Support | Sources |
|---|---|---|---|
| 1. The Ragnar Locker ransomware crew took TAP data in 2022. | fact | supported | none recorded |
| 2. The data covered more than 5 million people. | fact | contradicted | 1 (0 confirmed) |
| 3. TAP is a state-owned flag carrier. | fact | unsupported | none recorded |
| 4. The attackers published the data. | fact | supported | none recorded |
| 5. TAP refused to pay the ransom. | fact | unsupported | none recorded |
| 6. Refusal is defensible policy but transferred the harm wholesale onto passengers, who had no vote. | characterization | n/a | none recorded |
| 7. Nothing in a ticket contract gives a passenger a say in how the carrier responds to extortion. | characterization | n/a | none recorded |
0 of 7 claims have a confirmed source of their own.
Sources
| Source | Claim | Tier | Status | Quote |
|---|---|---|---|---|
| reporting · 2022-08 haveibeenpwned.com/Breach/TAPAirPortugal | Claim 2 | Unassigned | corrected | “Over 5M unique email addresses were exposed alongside other personal data” Quote basis: not recorded. |
Source vault
Link status: Candidate - not yet fetched
| Document | Last fetch | |
|---|---|---|
| Privacy policy flytap.com/en-us/legal/privacy-policy | Not fetched yet | NO (HTML only) |
| Terms of service flytap.com/en-us/legal/terms-and-conditions | Not fetched yet | NO (HTML only) |
| Website No URL recorded | Not fetched yet | — |
| Primary source https://haveibeenpwned.com/Breach/TAPAirPortugal Verification: Verified - primary source confirmed | Not fetched yet | — |
Enforcement
No enforcement actions are linked to this row.
State statute
No HQ state on file, so no state statute applies by headquarters.