Global Airlines (Top 40) · Airline (Europe, ULCC) · Regulatory action + Data breach
Wizz Air
Headline
The claimed 2025 breach has never been independently confirmed by Wizz Air, and that is the honest state of this row - an attacker assertion, not an established fact.
Not independently verified. Verification status: Unverified - heuristic first draft. Publish state: draft unverified.
The claimed 2025 breach has never been independently confirmed by Wizz Air, and that is the honest state of this row - an attacker assertion, not an established fact. What can be said without qualification is that Wizz Air's business model is built on unbundling, where the advertised fare is a fraction of what you actually pay and the remainder arrives through seat selection, bag sizing, priority boarding and check-in penalties. The contract term that matters most to an ultra-low-cost passenger is rarely a privacy clause; it is the airport check-in fee that can exceed the ticket price for a passenger who missed an online window.
- Severity
- Evidence tierUnassigned
- Claims confirmed
- Last verified2026-08-04
Primary source. None recorded — Unverified - heuristic first draft.
Terms
Arbitration
Not independently confirmed this pass — GDPR applies as a Hungary/EU-based carrier rather than a US-style arbitration clause.
Data sharing
CLAIMED BREACH (April-May 2025, NOT independently confirmed by Wizz Air): the STORMOUS extortion group listed Wizz Air on its leak site (posted about May 2, 2025, per ransomware.live), with breach tracker Breachsense recording a claimed leak size of 22 GIGABYTES; the Wizz Air Abu Dhabi joint venture was not named in sources retrieved this pass, and Wizz Air responded only that it 'has strong security systems in place' — the airline has made no public confirmation of the claim, illustrating the broader challenge (also seen with the United Airlines '272 million SMS records' claim referenced in the same research) of separating genuine breach claims from unverified or exaggerated criminal-forum postings.
Fees and billing
Not itemized this pass.
Contacts
Privacy contact. Not recorded.
Legal notice. Not verified this pass. If publicly traded: SEC Form 10-K cover page gives the official corporate address; the Secretary of State business-entity search in the state of incorporation gives the registered agent, which must accept service. If private: the state registered agent is usually the only reliable route.
Mailing address. Not recorded.
Evidence
No claims have been itemized for this row yet.
No sources are on file for this row yet.
Source vault
Link status: Candidate - not yet fetched
| Document | Last fetch | |
|---|---|---|
| Privacy policy wizzair.com/en-gb/information-and-services/privacy-notice | Not fetched yet | NO (HTML only) |
| Terms of service wizzair.com/en-gb/information-and-services/legal/general-conditions-of-carriage | Not fetched yet | NO (HTML only) |
| Website No URL recorded | Not fetched yet | — |
| Primary source No URL recorded Verification: Unverified - heuristic first draft | Not fetched yet | — |
Enforcement
No enforcement actions are linked to this row.
State statute
No HQ state on file, so no state statute applies by headquarters.