AI-Powered Cyberattack Steals 600,000 Credit Card Records in Five-Day Spree A sophisticated cyberattack leveraging AI models compromised at least 27 companies including a Fortune 500 hospitality firm, a major U.S. airline, and an online fashion retailer between September 10 and 15, exfiltrating over 600,000 credit card records. The operation, uncovered by cybersecurity firm Gambit Security, used autonomous AI agents to scan target websites for vulnerabilities, deploy skimmers on checkout pages, and harvest payment details before erasing evidence of access. In some cases, the cleanup process accidentally wiped victims’ data, including backups. The attack relied on a combination of Chinese AI systems DeepSeek and Kimi and an older version of Anthropic’s Claude Opus 4.6, which lacked the guardrails present in newer models. Anthropic confirmed it had banned the associated account after detecting the abuse. The hackers spent an average of $25.46 per target, with costs ranging from $3.13 to $79.31, totaling around $8,000 for the campaign. Of the stolen records, 488,000 (79%) belonged to American cardholders, with anti-fraud analysis confirming their legitimacy. The operation was orchestrated using three off-the-shelf AI frameworks Strix, Cairn, and Hermes each handling different phases of the attack. Gambit Security discovered the campaign after the hacker’s server infrastructure was left exposed online. Despite efforts by Cloudflare and the Shadowserver Foundation to dismantle the infrastructure, the attacker has repeatedly rebuilt it, and the attacks remain ongoing. Eyal Sela, director of threat intelligence at Gambit Security, described the incident as "one of the most severe abuses of AI for exploitation seen so far," noting the near-autonomous execution of sophisticated cyberattacks with minimal preparation and high success rates. The breach reflects a broader trend of AI-enabled intrusions accelerating in 2026, with one in four malicious breaches now leveraging AI a 56% increase over the previous year.

A preliminary report from the National Transportation Safety Board found indications maintenance errors could be at fault for an American Airlines plane that caught fire after making an emergency landing at Denver International Airport in March. Investigators discovered some parts were loose and appeared to be installed incorrectly, with one allowing fuel to leak from the fitting. The fire was put out in less than a minute by ground crews in Denver. Twelve people were taken to a hospital with minor injuries following the fire.

American Airlines reported a data breach involving its third-party vendor, pilotcredentials.com, on June 23, 2023. The breach occurred on or around April 30, 2023, and potentially exposed personal information of applicants, including names and Social Security numbers. Approximately 1,000 individuals were affected.

The Maine Office of the Attorney General reported on September 16, 2022, a data breach affecting American Airlines from July 3 to July 7, 2022, due to external system hacking. This breach involved personal data, including driver's license numbers, and affected a total of 1,708 individuals.

American Airlines suffered from a data breach incident, an unauthorized actor gained access to the personal information of customers and employees through a phishing campaign. The exposed information includes address, phone number, driver's license number, passport number, and certain medical information. They engaged a third-party cybersecurity forensic firm for the investigation and implemented additional technical safeguards to prevent a similar incident from occurring in the future.

The California Office of the Attorney General reported that American Airlines experienced unauthorized access to its online AAdvantage accounts, with the incident occurring on or about December 30, 2014. The breach potentially exposed personal information, including names, email addresses, phone numbers, and the last four digits of credit/debit cards, affecting an unspecified number of individuals. The breach was reported on January 15, 2015.