Incident : Data Breach

AIR414080825

Exposure Impact

Title: Cyberattack on Air France and KLM through a third-party service provider

Description: Unidentified hackers accessed Air France and KLM through a third-party service provider, stealing customer data including names, contact details, and more. Passport data was not compromised.

Type: Data Breach

Attack Vector: Third-party service provider compromise

Threat Actor: Unidentified (possibly Scattered Spider)

Incident : Data Breach

AIR541081825

Exposure Impact

Title: Air France-KLM Customer Service Platform Data Breach

Description: Air France and KLM detected unusual activity on an external customer service platform, leading to unauthorized access to customer data. Hackers accessed personal details including names, emails, phone numbers, loyalty program information, and recent transactions. No financial details were stolen, but the compromised data is valuable for cybercriminals. The breach is linked to the ShinyHunters group, which has targeted Salesforce customer service systems used by major brands. The attack leveraged AI-powered social engineering, including voice cloning and deepfake impersonations, to bypass security measures. Authorities in France and the Netherlands were notified, and affected customers were advised to monitor for phishing attempts and suspicious activity.

Type: Data Breach

Attack Vector: AI-Amplified Social EngineeringThird-Party Customer Service Platform ExploitationVoice CloningDeepfake Impersonation

Vulnerability Exploited: Human Weakness in Customer ServiceLack of Robust Security Controls on Third-Party PlatformsAI-Generated Convincing Impersonations

Threat Actor: ShinyHunters

Motivation: Financial GainData MonetizationIdentity TheftLoyalty Program Fraud

Incident : data breach

AIR1292412100725

Exposure Impact

Title: Air France Data Breach via Third-Party Vendor (Salesforce) Leading to Class Action Lawsuit

Description: Air France is facing a class action lawsuit over a cyber attack that resulted in the theft of personal details of tens of thousands of passengers, which were allegedly sold on the dark web. The breach occurred via a third-party vendor (Salesforce) supplying customer support software to Air France. Hackers accessed data including full names, contact details, frequent flyer status, and email subject lines. While no credit card or passport data was compromised, the stolen information could be used for identity theft or phishing scams. The lawsuit alleges Air France failed to implement adequate cybersecurity safeguards. The incident is linked to the Scattered Spider group, known for social engineering attacks.

Date Publicly Disclosed: 2025-08-mid

Type: data breach

Attack Vector: third-party vendor compromise (Salesforce)social engineering (Scattered Spider group)

Vulnerability Exploited: weak cybersecurity safeguards in third-party vendor (Salesforce)social engineering targeting IT helpdesks

Threat Actor: Scattered Spider group (alleged)unknown cybercriminals

Motivation: financial gain (data sold on dark web)identity theftphishing scams

Incident : Data Breach AIR414080825

Entity Name: Air France

Entity Type: Airline

Industry: Aviation

Incident : Data Breach AIR414080825

Entity Name: KLM Royal Dutch Airlines

Entity Type: Airline

Industry: Aviation

Incident : Data Breach AIR541081825

Entity Name: Air France

Entity Type: Airline

Industry: Aviation

Location: France

Size: Large (Global Carrier)

Incident : Data Breach AIR541081825

Entity Name: KLM

Entity Type: Airline

Industry: Aviation

Location: Netherlands

Size: Large (Global Carrier)

Incident : data breach AIR1292412100725

Entity Name: Air France

Entity Type: airline

Industry: aviation

Location: France

Size: large (part of Air France-KLM Group)

Customers Affected: tens of thousands

Incident : data breach AIR1292412100725

Entity Name: KLM Royal Dutch Airlines

Entity Type: airline

Industry: aviation

Location: Netherlands

Size: large (part of Air France-KLM Group)

Incident : data breach AIR1292412100725

Entity Name: Salesforce (third-party vendor)

Entity Type: software provider

Industry: technology

Location: USA

Size: large

Incident : data breach AIR1292412100725

Entity Name: Qantas

Entity Type: airline

Industry: aviation

Location: Australia

Size: large

Incident : data breach AIR1292412100725

Entity Name: Cartier

Entity Type: luxury retailer

Industry: retail

Incident : data breach AIR1292412100725

Entity Name: Louis Vuitton

Entity Type: luxury retailer

Industry: retail

Incident : data breach AIR1292412100725

Entity Name: Pandora

Entity Type: jewelry retailer

Industry: retail

Incident : Data Breach AIR414080825

Incident Response Plan Activated: True

Containment Measures: Corrective measures implemented

Communication Strategy: Data breach notification letters sent to affected customers

Incident : Data Breach AIR541081825

Incident Response Plan Activated: Yes

Third Party Assistance: External It Security Teams, Salesforce (Likely).

Law Enforcement Notified: French Authorities, Dutch Authorities,

Containment Measures: Immediate Access Revocation for AttackersIsolation of Affected Platform

Remediation Measures: Security Controls EnhancementPreventive Measures Implementation

Communication Strategy: Joint Public StatementDirect Customer NotificationsVigilance Advisories

Enhanced Monitoring: Yes

Incident : data breach AIR1292412100725

Remediation Measures: complimentary credit monitoring service for affected customers

Communication Strategy: public disclosure in August 2025customer advisories (likely)

Incident : Data Breach AIR414080825

Type of Data Compromised: Personal data

Sensitivity of Data: Moderate

Personally Identifiable Information: Full names, contact details

Incident : Data Breach AIR541081825

Type of Data Compromised: Personal identifiable information (pii), Loyalty program data, Transaction histories

Sensitivity of Data: Moderate to High (Enough for Impersonation and Targeted Scams)

Data Exfiltration: Yes

Personally Identifiable Information: NamesEmailsPhone NumbersLoyalty Program DetailsTransaction Records

Incident : data breach AIR1292412100725

Type of Data Compromised: Personally identifiable information (pii), Customer service request metadata

Number of Records Exposed: tens of thousands

Sensitivity of Data: moderate (no financial or passport data, but PII exposed)

Data Exfiltration: data sold on the dark web

File Types Exposed: customer support recordsemail metadata

Personally Identifiable Information: full namescontact detailsfrequent flyer status

Incident : Data Breach AIR414080825

Data Exfiltration: True

Incident : Data Breach AIR541081825

Data Exfiltration: Yes (But Not Ransomware-Related)

Incident : data breach AIR1292412100725

Data Exfiltration: ['data stolen and sold on dark web']

Incident : Data Breach AIR541081825

Regulatory Notifications: French Data Protection Authority (CNIL)Dutch Data Protection Authority (AP)

Incident : data breach AIR1292412100725

Legal Actions: class action lawsuit (case number: 1:25-cv-07634),

Incident : Data Breach AIR541081825

Lessons Learned: Third-party customer service platforms are high-value targets due to weak security controls and rich personal data., AI-powered impersonation (e.g., voice cloning, deepfakes) can bypass traditional human detection methods., Loyalty program data and transaction histories are lucrative for cybercriminals, enabling targeted scams and identity fraud., Rapid containment and customer communication are critical to mitigating reputational and operational damage., Multi-factor authentication (MFA) and phishing-resistant methods are essential for both customers and service representatives.

Incident : data breach AIR1292412100725

Lessons Learned: Third-party vendor risks must be rigorously assessed and mitigated, especially in high-target industries like aviation., Social engineering attacks (e.g., Scattered Spider tactics) require robust employee training and verification protocols., Public disclosure timing and transparency are critical to maintaining customer trust., Complimentary credit monitoring may not suffice for long-term harm caused by PII exposure.

Incident : Data Breach AIR541081825

Recommendations: Implement **phishing-resistant MFA** (e.g., app-based, biometric, or security keys) for all customer-facing and internal systems., Enhance **security controls on third-party platforms**, including behavioral analytics, anomaly detection, and strict access limits., Train customer service teams to recognize **AI-generated impersonations**, including voice cloning and deepfake red flags., Monitor **dark web markets** for stolen data (e.g., loyalty points, PII) and proactively alert affected customers., Encourage customers to use **unique passwords**, **password managers**, and **identity theft protection services**., Deploy **personal data removal services** to reduce exposure of customer information on data broker sites., Conduct **regular security audits** of third-party vendors, especially those handling sensitive customer data., Educate customers on **post-breach phishing risks**, including scams referencing real transactions or loyalty balances., Adopt **AI-driven fraud detection tools** to counter AI-powered attacks, creating a defensive 'AI arms race.', Establish a **dedicated incident response team** for third-party breaches, with clear escalation paths to law enforcement.Implement **phishing-resistant MFA** (e.g., app-based, biometric, or security keys) for all customer-facing and internal systems., Enhance **security controls on third-party platforms**, including behavioral analytics, anomaly detection, and strict access limits., Train customer service teams to recognize **AI-generated impersonations**, including voice cloning and deepfake red flags., Monitor **dark web markets** for stolen data (e.g., loyalty points, PII) and proactively alert affected customers., Encourage customers to use **unique passwords**, **password managers**, and **identity theft protection services**., Deploy **personal data removal services** to reduce exposure of customer information on data broker sites., Conduct **regular security audits** of third-party vendors, especially those handling sensitive customer data., Educate customers on **post-breach phishing risks**, including scams referencing real transactions or loyalty balances., Adopt **AI-driven fraud detection tools** to counter AI-powered attacks, creating a defensive 'AI arms race.', Establish a **dedicated incident response team** for third-party breaches, with clear escalation paths to law enforcement.Implement **phishing-resistant MFA** (e.g., app-based, biometric, or security keys) for all customer-facing and internal systems., Enhance **security controls on third-party platforms**, including behavioral analytics, anomaly detection, and strict access limits., Train customer service teams to recognize **AI-generated impersonations**, including voice cloning and deepfake red flags., Monitor **dark web markets** for stolen data (e.g., loyalty points, PII) and proactively alert affected customers., Encourage customers to use **unique passwords**, **password managers**, and **identity theft protection services**., Deploy **personal data removal services** to reduce exposure of customer information on data broker sites., Conduct **regular security audits** of third-party vendors, especially those handling sensitive customer data., Educate customers on **post-breach phishing risks**, including scams referencing real transactions or loyalty balances., Adopt **AI-driven fraud detection tools** to counter AI-powered attacks, creating a defensive 'AI arms race.', Establish a **dedicated incident response team** for third-party breaches, with clear escalation paths to law enforcement.Implement **phishing-resistant MFA** (e.g., app-based, biometric, or security keys) for all customer-facing and internal systems., Enhance **security controls on third-party platforms**, including behavioral analytics, anomaly detection, and strict access limits., Train customer service teams to recognize **AI-generated impersonations**, including voice cloning and deepfake red flags., Monitor **dark web markets** for stolen data (e.g., loyalty points, PII) and proactively alert affected customers., Encourage customers to use **unique passwords**, **password managers**, and **identity theft protection services**., Deploy **personal data removal services** to reduce exposure of customer information on data broker sites., Conduct **regular security audits** of third-party vendors, especially those handling sensitive customer data., Educate customers on **post-breach phishing risks**, including scams referencing real transactions or loyalty balances., Adopt **AI-driven fraud detection tools** to counter AI-powered attacks, creating a defensive 'AI arms race.', Establish a **dedicated incident response team** for third-party breaches, with clear escalation paths to law enforcement.Implement **phishing-resistant MFA** (e.g., app-based, biometric, or security keys) for all customer-facing and internal systems., Enhance **security controls on third-party platforms**, including behavioral analytics, anomaly detection, and strict access limits., Train customer service teams to recognize **AI-generated impersonations**, including voice cloning and deepfake red flags., Monitor **dark web markets** for stolen data (e.g., loyalty points, PII) and proactively alert affected customers., Encourage customers to use **unique passwords**, **password managers**, and **identity theft protection services**., Deploy **personal data removal services** to reduce exposure of customer information on data broker sites., Conduct **regular security audits** of third-party vendors, especially those handling sensitive customer data., Educate customers on **post-breach phishing risks**, including scams referencing real transactions or loyalty balances., Adopt **AI-driven fraud detection tools** to counter AI-powered attacks, creating a defensive 'AI arms race.', Establish a **dedicated incident response team** for third-party breaches, with clear escalation paths to law enforcement.Implement **phishing-resistant MFA** (e.g., app-based, biometric, or security keys) for all customer-facing and internal systems., Enhance **security controls on third-party platforms**, including behavioral analytics, anomaly detection, and strict access limits., Train customer service teams to recognize **AI-generated impersonations**, including voice cloning and deepfake red flags., Monitor **dark web markets** for stolen data (e.g., loyalty points, PII) and proactively alert affected customers., Encourage customers to use **unique passwords**, **password managers**, and **identity theft protection services**., Deploy **personal data removal services** to reduce exposure of customer information on data broker sites., Conduct **regular security audits** of third-party vendors, especially those handling sensitive customer data., Educate customers on **post-breach phishing risks**, including scams referencing real transactions or loyalty balances., Adopt **AI-driven fraud detection tools** to counter AI-powered attacks, creating a defensive 'AI arms race.', Establish a **dedicated incident response team** for third-party breaches, with clear escalation paths to law enforcement.Implement **phishing-resistant MFA** (e.g., app-based, biometric, or security keys) for all customer-facing and internal systems., Enhance **security controls on third-party platforms**, including behavioral analytics, anomaly detection, and strict access limits., Train customer service teams to recognize **AI-generated impersonations**, including voice cloning and deepfake red flags., Monitor **dark web markets** for stolen data (e.g., loyalty points, PII) and proactively alert affected customers., Encourage customers to use **unique passwords**, **password managers**, and **identity theft protection services**., Deploy **personal data removal services** to reduce exposure of customer information on data broker sites., Conduct **regular security audits** of third-party vendors, especially those handling sensitive customer data., Educate customers on **post-breach phishing risks**, including scams referencing real transactions or loyalty balances., Adopt **AI-driven fraud detection tools** to counter AI-powered attacks, creating a defensive 'AI arms race.', Establish a **dedicated incident response team** for third-party breaches, with clear escalation paths to law enforcement.Implement **phishing-resistant MFA** (e.g., app-based, biometric, or security keys) for all customer-facing and internal systems., Enhance **security controls on third-party platforms**, including behavioral analytics, anomaly detection, and strict access limits., Train customer service teams to recognize **AI-generated impersonations**, including voice cloning and deepfake red flags., Monitor **dark web markets** for stolen data (e.g., loyalty points, PII) and proactively alert affected customers., Encourage customers to use **unique passwords**, **password managers**, and **identity theft protection services**., Deploy **personal data removal services** to reduce exposure of customer information on data broker sites., Conduct **regular security audits** of third-party vendors, especially those handling sensitive customer data., Educate customers on **post-breach phishing risks**, including scams referencing real transactions or loyalty balances., Adopt **AI-driven fraud detection tools** to counter AI-powered attacks, creating a defensive 'AI arms race.', Establish a **dedicated incident response team** for third-party breaches, with clear escalation paths to law enforcement.Implement **phishing-resistant MFA** (e.g., app-based, biometric, or security keys) for all customer-facing and internal systems., Enhance **security controls on third-party platforms**, including behavioral analytics, anomaly detection, and strict access limits., Train customer service teams to recognize **AI-generated impersonations**, including voice cloning and deepfake red flags., Monitor **dark web markets** for stolen data (e.g., loyalty points, PII) and proactively alert affected customers., Encourage customers to use **unique passwords**, **password managers**, and **identity theft protection services**., Deploy **personal data removal services** to reduce exposure of customer information on data broker sites., Conduct **regular security audits** of third-party vendors, especially those handling sensitive customer data., Educate customers on **post-breach phishing risks**, including scams referencing real transactions or loyalty balances., Adopt **AI-driven fraud detection tools** to counter AI-powered attacks, creating a defensive 'AI arms race.', Establish a **dedicated incident response team** for third-party breaches, with clear escalation paths to law enforcement.Implement **phishing-resistant MFA** (e.g., app-based, biometric, or security keys) for all customer-facing and internal systems., Enhance **security controls on third-party platforms**, including behavioral analytics, anomaly detection, and strict access limits., Train customer service teams to recognize **AI-generated impersonations**, including voice cloning and deepfake red flags., Monitor **dark web markets** for stolen data (e.g., loyalty points, PII) and proactively alert affected customers., Encourage customers to use **unique passwords**, **password managers**, and **identity theft protection services**., Deploy **personal data removal services** to reduce exposure of customer information on data broker sites., Conduct **regular security audits** of third-party vendors, especially those handling sensitive customer data., Educate customers on **post-breach phishing risks**, including scams referencing real transactions or loyalty balances., Adopt **AI-driven fraud detection tools** to counter AI-powered attacks, creating a defensive 'AI arms race.', Establish a **dedicated incident response team** for third-party breaches, with clear escalation paths to law enforcement.

Incident : data breach AIR1292412100725

Recommendations: Implement multi-factor authentication (MFA) and stricter access controls for third-party vendors., Conduct regular security audits of third-party software providers, especially those handling customer data., Enhance employee training to detect and prevent social engineering attacks (e.g., fake IT helpdesk calls)., Develop a more comprehensive incident response plan, including long-term support for affected customers (e.g., identity theft protection)., Monitor dark web markets for exposed customer data and proactively notify affected individuals., Collaborate with industry peers (e.g., Qantas, other airlines) to share threat intelligence and best practices.Implement multi-factor authentication (MFA) and stricter access controls for third-party vendors., Conduct regular security audits of third-party software providers, especially those handling customer data., Enhance employee training to detect and prevent social engineering attacks (e.g., fake IT helpdesk calls)., Develop a more comprehensive incident response plan, including long-term support for affected customers (e.g., identity theft protection)., Monitor dark web markets for exposed customer data and proactively notify affected individuals., Collaborate with industry peers (e.g., Qantas, other airlines) to share threat intelligence and best practices.Implement multi-factor authentication (MFA) and stricter access controls for third-party vendors., Conduct regular security audits of third-party software providers, especially those handling customer data., Enhance employee training to detect and prevent social engineering attacks (e.g., fake IT helpdesk calls)., Develop a more comprehensive incident response plan, including long-term support for affected customers (e.g., identity theft protection)., Monitor dark web markets for exposed customer data and proactively notify affected individuals., Collaborate with industry peers (e.g., Qantas, other airlines) to share threat intelligence and best practices.Implement multi-factor authentication (MFA) and stricter access controls for third-party vendors., Conduct regular security audits of third-party software providers, especially those handling customer data., Enhance employee training to detect and prevent social engineering attacks (e.g., fake IT helpdesk calls)., Develop a more comprehensive incident response plan, including long-term support for affected customers (e.g., identity theft protection)., Monitor dark web markets for exposed customer data and proactively notify affected individuals., Collaborate with industry peers (e.g., Qantas, other airlines) to share threat intelligence and best practices.Implement multi-factor authentication (MFA) and stricter access controls for third-party vendors., Conduct regular security audits of third-party software providers, especially those handling customer data., Enhance employee training to detect and prevent social engineering attacks (e.g., fake IT helpdesk calls)., Develop a more comprehensive incident response plan, including long-term support for affected customers (e.g., identity theft protection)., Monitor dark web markets for exposed customer data and proactively notify affected individuals., Collaborate with industry peers (e.g., Qantas, other airlines) to share threat intelligence and best practices.Implement multi-factor authentication (MFA) and stricter access controls for third-party vendors., Conduct regular security audits of third-party software providers, especially those handling customer data., Enhance employee training to detect and prevent social engineering attacks (e.g., fake IT helpdesk calls)., Develop a more comprehensive incident response plan, including long-term support for affected customers (e.g., identity theft protection)., Monitor dark web markets for exposed customer data and proactively notify affected individuals., Collaborate with industry peers (e.g., Qantas, other airlines) to share threat intelligence and best practices.

Incident : Data Breach AIR414080825

Source: Tweakers

Incident : Data Breach AIR414080825

Source: Cybernews

Incident : Data Breach AIR541081825

Source: Fox News - CyberGuy Report

URL: https://www.foxnews.com/tech/air-france-klm-data-breach-hackers-access-customer-details

Incident : Data Breach AIR541081825

Source: Incode Technologies (Ricardo Amper, CEO)

Incident : Data Breach AIR541081825

Source: CyberGuy.com - Protection Tips

URL: https://www.cyberguy.com/

Incident : data breach AIR1292412100725

Source: Class action lawsuit filing (Southern District of New York)

Incident : data breach AIR1292412100725

Source: Air France-KLM Group public disclosure (August 2025)

Incident : data breach AIR1292412100725

Source: Unit 42 report on Scattered Spider targeting airlines

Incident : Data Breach AIR541081825

Investigation Status: Ongoing (Authorities Notified, Containment Achieved)

Incident : data breach AIR1292412100725

Investigation Status: ['ongoing (class action lawsuit in progress)', 'no public details on technical investigation']

Incident : Data Breach AIR414080825

Customer Advisories: Data breach notification letters sent

Incident : Data Breach AIR541081825

Stakeholder Advisories: Customers Advised To Enable Mfa, Monitor Accounts, And Watch For Phishing Attempts., Airlines Urged To Audit Third-Party Security And Enhance Employee Training On Ai Impersonation Risks..

Customer Advisories: Be vigilant for **phishing emails/phone calls** referencing recent flights or loyalty programs.Enable **multi-factor authentication (MFA)** on all accounts, especially airline and financial services.Monitor **loyalty program balances** and **bank statements** for unauthorized activity.Use **strong, unique passwords** and a **password manager** to prevent credential stuffing.Consider **identity theft protection** and **personal data removal services** to reduce exposure.Report suspicious activity to the airline and relevant authorities immediately.

Incident : data breach AIR1292412100725

Customer Advisories: complimentary credit monitoring offeredlikely notifications to affected passengers

Incident : Data Breach AIR414080825

Entry Point: Third-party service provider

Incident : Data Breach AIR541081825

Entry Point: Third-Party Customer Service Platform (Likely Salesforce)

High Value Targets: Customer Pii, Loyalty Program Data, Transaction Histories,

Data Sold on Dark Web: Customer Pii, Loyalty Program Data, Transaction Histories,

Incident : data breach AIR1292412100725

Entry Point: Compromised Salesforce Customer Support Software,

High Value Targets: Customer Pii, Frequent Flyer Data,

Data Sold on Dark Web: Customer Pii, Frequent Flyer Data,

Incident : Data Breach AIR541081825

Root Causes: Over-Reliance On Third-Party Platforms With Inadequate Security Controls., Lack Of Preparedness For Ai-Powered Social Engineering Attacks (E.G., Voice Cloning)., Human Vulnerability In Customer Service Roles, Exploited Via Convincing Impersonations., Insufficient Segmentation Between Third-Party Systems And Core Airline Networks (Though Internal Systems Remained Secure).,

Corrective Actions: Terminated Attackers' Access And Secured The Compromised Platform., Implemented Additional Security Measures To Prevent Recurrence (Details Undisclosed)., Notified Regulatory Authorities In France And The Netherlands., Communicated Transparently With Affected Customers, Advising Vigilance., Likely Reviewing Third-Party Vendor Security Policies And Ai Fraud Detection Capabilities.,

Incident : data breach AIR1292412100725

Root Causes: Inadequate Cybersecurity Safeguards At Third-Party Vendor (Salesforce)., Lack Of Employee Training To Prevent Social Engineering Attacks (E.G., Scattered Spider Tactics)., Failure To Anticipate And Mitigate Risks Despite Prior Warnings (E.G., Qantas Breach In July 2025).,