Spanish flag service Iberia has begun notifying clients of an information security incident stemming from a compromise at certainly one of its suppliers.
The disclosure comes days after a risk actor claimed on hacker boards to have entry to 77 GB of information allegedly stolen from the airline.
Buyer information affected
Iberia, Spain’s largest airline and a part of IAG (Worldwide Airways Group), says unauthorized entry to a provider’s methods resulted within the publicity of sure buyer data.
In keeping with an electronic mail seen by risk intelligence platform Hackmanac, the compromised information might embrace:
- Buyer’s identify and surname
- E mail deal with
- Loyalty card (Iberia Membership) identification quantity
The airline says clients’ Iberia account login credentials and passwords weren’t compromised, nor was any banking or cost card data accessed.
“As quickly as we grew to become conscious of the incident, we activated our security protocol and procedures and carried out all vital technical and organizational measures to comprise it, mitigate its results, and stop its recurrence,” states the security discover mailed out in Spanish.
Iberia says it has added further protections across the electronic mail deal with linked to buyer accounts, now requiring a verification code earlier than any modifications could be made.
The airline can be monitoring its methods for suspicious exercise. Related authorities have been notified, and the investigation stays ongoing in coordination with the concerned provider.
“As of the date of this communication, we’ve got no proof of any fraudulent use of this information. In any case, we suggest that you simply take note of any suspicious communications chances are you’ll obtain to keep away from any potential issues they might trigger. We encourage you to report any anomalous or suspicious exercise you detect to our name heart by calling the next phone quantity: +34 900111500,” continues the e-mail.
Disclosure follows information theft claims
The timing of the disclosure is noteworthy, because it follows a declare made roughly every week in the past by a risk actor on-line that they’d entry to 77 GB of purported Iberia information and have been making an attempt to promote it for $150,000.
Within the discussion board put up (proven beneath), the risk actor claimed the trove was “extracted straight from [the airline’s] inner servers” and contained A320/A321 technical information, AMP upkeep recordsdata, engine data, and different inner paperwork:
It isn’t clear whether or not the purported information dump is said to Iberia’s incident, because the itemizing doesn’t point out the shopper data Iberia says was uncovered. Moreover, the airline attributes the breach to a third-party vendor quite than its personal servers.
BleepingComputer has not verified the authenticity of the info marketed on-line. We have now approached Iberia’s press workforce with additional questions and can replace this text as soon as we hear again.
Within the meantime, Iberia clients and companions ought to stay cautious of any unsolicited or suspicious messages claiming to come back from the airline, as these could also be phishing or social engineering makes an attempt.
It is price range season! Over 300 CISOs and security leaders have shared how they’re planning, spending, and prioritizing for the 12 months forward. This report compiles their insights, permitting readers to benchmark methods, establish rising tendencies, and evaluate their priorities as they head into 2026.
Learn the way high leaders are turning funding into measurable affect.
