Air France-KLM confirms data breach via third-party system

Air France and KLM Royal Dutch Airlines are notifying customers about a data breach that occurred through a third-party service provider, exposing personal information of loyalty program members and other passengers. The incident originated from a platform used by the airlines' customer service teams, allowing attackers to access customer data held by the vendor.

The compromised data includes full names, contact details, Flying Blue loyalty program numbers and membership tiers, and subject lines of customer service emails. However, the airlines confirmed that passport numbers, payment details, account passwords, and Flying Blue miles balances were not exposed.

While the exact number of affected individuals has not been disclosed, the airlines warned that the accessed information could make customers vulnerable to phishing and impersonation attacks. Customers are advised to be cautious of unsolicited messages requesting personal or payment information.

The breach was reported to the Dutch Data Protection Authority and the Commission Nationale de l’Informatique et des Libertés. Some customers expressed anger on social media, noting that the airlines' statement implied the attack was fended off, rather than that personal information was breached.