Air France and KLM suffered a data breach on their external customer service platform, where hackers gained unauthorized access to customer personal data, including names, emails, phone numbers, loyalty program details, and recent transactions. While no financial data was stolen, the exposed information remains highly valuable for cybercriminals, enabling AI-powered impersonation attacks, phishing, and fraudulent account takeovers. The breach was linked to the ShinyHunters hacker group, which exploited third-party vulnerabilities in Salesforce-based customer service systems. Authorities in France and the Netherlands were notified, and affected customers were advised to monitor for suspicious communications and fraudulent activity. The airlines confirmed that internal systems remained secure, but the incident highlights the growing risk of AI-driven social engineering attacks targeting customer support portals.

In a recent cybersecurity incident involving Air France, the airline fell victim to a third-party supply chain breach, a growing trend highlighted in the Verizon DBIR report (2025). The attack exploited vulnerabilities within one of Air France’s critical vendors, likely a supplier handling passenger data, booking systems, or operational logistics. While specifics remain undisclosed, the breach led to unauthorized access to customer personal and financial information, including booking details, payment records, and potentially frequent flyer accounts. The incident triggered regulatory scrutiny under GDPR, given the exposure of EU citizen data, and prompted Air France to initiate emergency containment protocols. Customers reported fraudulent transactions linked to compromised accounts, while the airline faced reputational damage due to media coverage and public distrust. Operational disruptions, such as delayed refunds or loyalty program freezes, further exacerbated the fallout. Air France’s cyber insurance premiums are expected to surge, reflecting heightened risk exposure. The breach underscores the cascading risks of supply chain vulnerabilities, where a single weak link in a vendor’s security posture can cripple a global enterprise.

Air France suffered a cyber attack via a third-party vendor (Salesforce), compromising the personal data of tens of thousands of passengers, including full names, contact details, frequent flyer status, and email subject lines from service requests. While credit card or passport data was not accessed, the stolen information was allegedly sold on the dark web, exposing victims to identity theft and phishing scams. The breach, linked to the Scattered Spider hacking group, exploited social engineering tactics to infiltrate Air France’s customer support systems. A class-action lawsuit (filed in New York under 1:25-cv-07634) accuses the airline of negligent cybersecurity practices, failing to prevent, detect, or mitigate the breach despite prior warnings about aviation sector vulnerabilities. Although Air France offered complimentary credit monitoring, plaintiffs argue this does not address the long-term risks of fraud and privacy violations. The incident mirrors a similar attack on Qantas via the same Salesforce vulnerability in July 2023.