Spanish flag carrier Iberia has begun notifying customers of a data security incident stemming from a compromise at one of its suppliers.
The disclosure comes days after a threat actor claimed on hacker forums to have access to 77 GB of data allegedly stolen from the airline.
Customer data affected
Iberia, Spain’s largest airline andpart of IAG (International Airlines Group), says unauthorized access to a supplier’ssystems resulted in the exposure of certain customer information.
email seen bythreat intelligence platform Hackmanac, the compromised data may include:
- Customer’s name and surname
- Email address
- Loyalty card (Iberia Club)identification number
The airline says customers’Iberia account login credentials and passwords were not compromised, nor was any banking or payment card information accessed.
Iberia says it has added additional protections around the email address linked to customer accounts, now requiring a verification code before any changes can be made.
The airline is also monitoring its systems for suspicious activity. Relevant authorities have been notified, and the investigation remains ongoing in coordination with the involved supplier.
“As of the date of this communication, we have no evidence of any fraudulent use of this data. In any case, we recommend that you pay attention to any suspicious communications you may receive to avoid any potential problems they may cause. We encourage you to report any anomalousor suspicious activity you detect to our call center by calling the following telephone number: +34 900111500,” continues the email.
Disclosure follows data theft claims
The timing of the disclosure is noteworthy, as it follows a claim made roughly a week ago by a threat actor online that they had access to 77 GB of purported Iberia data and were attempting to sell it for $150,000.
In the forum post (shown below), the threat actor claimed the trove was “extracted directly from [the airline’s] internal servers”and contained A320/A321 technical data, AMP maintenance files, engine information, and other internal documents:
Secrets Security Cheat Sheet: From Sprawl to Control
Whether you’re cleaning up old keys or setting guardrails for AI-generated code, this guide helps your team build securely from the start.
Get the cheat sheet and take the guesswork out of secrets management.
Ax Sharma
Ax Sharma is a security researcher and journalist focused on malware analyses and cybercrime investigations. His expertise includes open source software security, threat intel analysis, and reverse engineering. Frequently featured by leading media outlets like the BBC, Channel 5 (UK), Fortune, WIRED, among others, Ax is an active community member of the OWASP Foundation and the Canadian Association of Journalists (CAJ).
Send any tips via email or Twitter DM.
You may also like: