Air France & KLM allegedly targeted by shinyhunters in massive data leak

• Ransomware group: shinyhunters
• Country: France
• Sector: Transportation
• Announcement date: October 3, 2025

Shinyhunters claims to have leaked massive dataset from Air France & KLM

The threat group known as shinyhunters has issued an announcement on a leak site claiming to have compromised a significant amount of data belonging to the international aviation group Air France & KLM. According to the claims made by the group on October 3, 2025, the breach involves a massive volume of information, potentially impacting both the company's customers and its employees. The group asserts that the data exfiltration occurred around July 29, 2025.

This type of announcement is a common tactic used by cybercriminal groups operating via ransomware leak sites. These actors often employ a strategy known as double extortion, where they not only encrypt an organization's systems to disrupt operations but also steal sensitive data to use as leverage. By threatening to publish stolen information on public forums, these groups aim to exert maximum pressure on the victim organization to fulfill ransom demands. While the specific ransom demand in this instance was not mentioned in the announcement, the act of publishing such a large dataset is a clear attempt to damage the organization's reputation and operational security.

Details of the alleged data breach

The threat actor shinyhunters claims to have exfiltrated a dataset totaling approximately 51 GB in size. The announcement asserts that this stolen information contains over 12.3 million records of Personally Identifiable Information (PII). The scale of this alleged breach suggests a highly targeted operation aimed at harvesting sensitive details that can be used for various malicious purposes.

The specific types of data allegedly included in the leak are highly sensitive and cover multiple facets of the organization's operations. The group claims that the following information has been compromised:

• Full names
• Email addresses
• Phone numbers
• Residence addresses
• Flying Blue numbers
• Country of residence
• Employee information
• Flight information
• Internal email contents
• Live chat transcripts between employees and customers

The inclusion of internal communications, such as email contents and live chat transcripts, is particularly significant. Such data can provide attackers with insights into internal business processes, employee identities, and direct customer interactions, which can be exploited for further social engineering or phishing campaigns.

About Air France-KLM

Air France-KLM is an international aviation group formed by the merger of the French and Dutch flag carrier airlines. The company operates passenger transport, cargo services, and aircraft maintenance and repair activities worldwide.

Potential impact and organizational risks

The alleged breach of Air France & KLM poses significant risks to both the organization and the individuals whose data has been compromised. For customers and employees, the exposure of names, addresses, phone numbers, and loyalty program details like Flying Blue numbers creates a high risk of identity theft and highly targeted phishing attacks. Attackers can use the specific details of flight information or previous customer service interactions to craft convincing messages that trick individuals into revealing even more sensitive information.

From a regulatory perspective, the nature of the data involved suggests that the organization may face intense scrutiny under the European Union's General Data Protection Regulation (GDPR). The exposure of PII on a public leak site often triggers mandatory reporting requirements and potential legal or financial penalties. Furthermore, the leakage of internal emails and live chat transcripts could result in lasting damage to the organization's reputation and professional standing.

In the transportation sector, where trust and data privacy are paramount for passenger safety and service reliability, such incidents can have wide-reaching consequences. Organizations in this sector typically focus on robust defensive measures to mitigate these risks, such as implementing multi-factor authentication, maintaining strict access controls, and conducting regular security audits. Given the sensitivity of the alleged data, the operational security of the organization may have been significantly impacted by this event.