Cyber Incident Victim: Air France
Date:
Jan 2023
Location:
France
Summary
Air France and KLM notified customers of unauthorized access to accounts within their shared Flying Blue loyalty program, which serves multiple partner airlines. Suspicious activity was detected and blocked, with corrective measures implemented to prevent further data exposure; impacted accounts were locked, requiring password resets. Compromised information included names, email addresses, phone numbers, recent transaction details, and loyalty points balances, but payment data, credit card numbers, and passport information were not accessed. The airlines confirmed reporting the incident to relevant data protection authorities and emphasized that no miles were fraudulently used due to timely intervention.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 2 motives | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
In early January 2023, Air France and KLM detected unauthorized activity targeting customer accounts within their shared Flying Blue loyalty program, which serves multiple partner airlines including Transavia, Aircalin, Kenya Airways, and TAROM. Security teams identified suspicious behavior by an unauthorized entity, prompting immediate corrective measures to limit further data exposure. The airlines began notifying affected customers on or around January 6, 2023, confirming that personal information had been compromised. Exposed data included customer names, email addresses, telephone numbers, details of recent transactions, and Flying Blue-specific information such as accrued mileage balances. The breach did not compromise financial data such as credit card details or payment information, nor did it expose passport numbers. Customers reported receiving breach notifications through multiple channels, with some confirmation occurring via KLM's official Twitter account interactions.
Air France and KLM implemented containment measures including account locks for impacted users, requiring password resets through official airline websites to restore access. The airlines publicly stated that attackers were blocked before any loyalty miles could be fraudulently redeemed or transferred. Both organizations filed mandatory breach notifications with relevant data protection authorities in their respective countries. Impacted individuals were advised to monitor their accounts for suspicious activity despite assurances that sensitive data remained protected. The incident exclusively affected Flying Blue program members without disrupting core airline operations or reservation systems.