Cyber Incident Victim: Air France-KLM
Date:
Nov 2025
Location:
France
Summary
The airline group issued a statement announcing that a security incident had resulted in the exposure of personal data belonging to its customers. The disclosure confirmed that the breach had affected the airline group's clientele by compromising their personal information. KLM subsequently communicated directly with its customers to notify them that their personal data had been compromised in the incident. The notification was provided to customers concerning the data breach.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 0 motives | 0 techniques |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On September 1, 2025, Air France and KLM publicly disclosed that they had experienced data breaches affecting their customers. The disclosures were made through separate communications from each airline. The Air France statement was published on BleepingComputer, while KLM issued a notice on its Dutch news site. Both notifications indicated that personal data of customers had been compromised. The announcements did not specify the exact nature or volume of the data involved. They confirmed that the incidents were identified and that appropriate measures were being taken.
KLM's notice, titled "KLM informeert klanten over incident met persoonsgegevens," was directed at its Dutch-speaking clientele and confirmed that personal information had been involved in the security incident. The communication advised customers to remain vigilant regarding potential misuse of their data. Air France's disclosure similarly highlighted that customer data had been impacted, though it did not provide language‑specific details. Both airlines stated that they were cooperating with relevant authorities and internal security teams to investigate the breaches. The public statements marked the official acknowledgment of the incidents by the Air France‑KLM group. No further technical details were disclosed in the available sources.