Cyber Incident Victim: Frontier Airlines
Timeline
Summary
Frontier Airlines suffered two data breaches that exposed customers' Social Security numbers, addresses and government‑issued identification details. The airline did not inform those impacted until several weeks after the incidents, leading to two class‑action lawsuits filed in Colorado alleging inadequate security measures and delayed notification. The lawsuits, which name a hacker group known as Scattered Lapsus$ Hunters as the suspected perpetrator, seek financial compensation, three years of credit monitoring and injunctive relief for affected individuals nationwide. While the exact number of victims has not been disclosed, confirmed cases have been reported in multiple states.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 0 motives | 0 techniques |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
On May 12, 2026, Frontier Airlines experienced a data breach that was later identified as part of a series of intrusions. A second breach occurred on June 3, 2026, affecting customer and employee data. The intrusions were attributed to the hacker group known as Scattered Lapsus$ Hunters, which accessed Social Security numbers, addresses, and government‑issued identification details. Frontier Airlines became aware of the June breach by June 18, 2026, but did not issue notifications to affected individuals at that time. On or about July 9, 2026, the airline disclosed the breach to the Vermont Attorney General and began sending notifications to victims. The delayed notification meant that individuals were not informed until weeks after the initial exposures.
The exposure of personal data increased the risk of identity theft and fraud for those whose information was compromised, and the delay prevented victims from taking timely protective measures such as freezing credit or changing passwords. Two class action lawsuits were filed on July 15, 2026, in the United States District Court for the District of Colorado, alleging that Frontier Airlines failed to protect data and prioritized profits over adequate security investments. The plaintiffs, identified as Grace Stean and Kimah Beach, seek a nationwide class action, requesting three years of credit monitoring, monetary damages, and injunctive relief. Edelson Lechtzin LLP launched an investigation into the breach on July 10, 2026, and is evaluating potential claims on behalf of affected individuals. Frontier Airlines has not issued a public response to the allegations or the requests for compensation. The ongoing litigation highlights the legal and reputational consequences faced by the airline following the data breaches.