Air France-KLM

Profile narrative

Air France-KLM is a France-headquartered airline group associated with the Air France and KLM airline brands. Its core business is air transport, including passenger services and airline-related travel services across domestic, European, and intercontinental markets. The group’s activities also include customer-facing digital services such as online account management and the shared Flying Blue loyalty program, which handles member profile data, recent transactions, and accrued miles balances. Through its airline brands, it serves travelers and customers who use scheduled air travel, loyalty benefits, and related booking and account services.

Air France-KLM’s structure is that of a group encompassing Air France and KLM, with both airlines operating as recognizable carrier brands under the group. This structure is reflected in joint customer communications and shared programs such as Flying Blue. The group sits in the commercial aviation sector, where operations depend on large-scale booking, customer account, loyalty, and passenger data processing. Its public profile therefore includes both transport-service operations and the protection of customer information linked to airline accounts and loyalty membership.

Relevant public security events show the types of risks associated with these activities. In January 2023, Air France and KLM notified customers of a breach affecting the shared Flying Blue loyalty program. The exposed information included names, email addresses, phone numbers, recent transactions, and accrued miles balances. The companies stated that unauthorized access was detected and blocked, that no sensitive payment or passport data was exposed, that impacted accounts were locked, and that affected users were required to reset passwords. The incident was also reported to relevant data protection authorities.

Later, in September and November 2025, Air France-KLM disclosed incidents involving unauthorized access to customer information and compromise of customer personal data. Affected individuals were informed, and the companies stated that they had taken immediate protective steps and were cooperating with authorities to investigate and strengthen security measures. In December 2020, the group was reported to have been targeted by a cyber attack in which attackers attempted to breach its systems to collect intelligence that could support a later attack. The available information on that event did not explicitly report operational disruption or confirmed data compromise. These incidents place Air France-KLM in the category of a commercial aviation organisation with significant customer-data exposure across airline and loyalty-program services.

Incidents

4 incidents linked to this organisation.