Cyber Incident Victim: Air France-KLM
Date:
Jan 2023
Location:
Netherlands
Summary
Air France and KLM notified customers of a breach affecting their shared Flying Blue loyalty program, which compromised personal information including names, email addresses, phone numbers, recent transactions, and accrued miles balances. The airlines confirmed unauthorized access was detected and blocked, with no exposure of sensitive payment or passport data; impacted accounts were locked, requiring password resets, and the incident was reported to relevant data protection authorities.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
Air France and KLM detected unauthorized activity targeting customer accounts within their shared Flying Blue loyalty program in early January 2023. Security teams identified suspicious behavior by an external entity accessing member accounts, prompting immediate corrective measures to prevent further data exposure. The Flying Blue program serves customers of multiple airlines, including Air France, KLM, Transavia, Aircalin, Kenya Airways, and TAROM, allowing members to redeem loyalty points for travel rewards. Both airlines issued breach notifications confirming the incident had exposed personal information including customer names, email addresses, telephone numbers, recent transaction histories, and current Flying Blue mileage balances. KLM publicly acknowledged via Twitter that the attack had been successfully blocked before loyalty miles could be fraudulently redeemed.
The compromised accounts were automatically locked as a security precaution, requiring affected customers to reset passwords through official Air France or KLM websites. Airlines emphasized that payment card details, passport information, and other sensitive financial data remained protected throughout the incident. Official statements confirmed the breach did not involve compromise of backend reservation or payment systems, limiting exposure to front-end account profiles. Customers received direct communications advising password changes while both carriers reported the incident to relevant data protection authorities in their respective jurisdictions. The coordinated response included continuous monitoring of account activity and reinforcement of existing security protocols across the loyalty platform.