Security Experts:

Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Cybercrime

Air France, KLM Customers Warned of Loyalty Program Account Hacking

Franco-Dutch airline company Air France-KLM has started informing Flying Blue customers of a data breach involving their user accounts.

Air France-KLM was formed in 2004, following the merger between Air France and KLM. Flying Blue is their loyalty program, also used by Aircalin, Kenya Airways, TAROM, and Transavia.

Franco-Dutch airline company Air France-KLM has started informing Flying Blue customers of a data breach involving their user accounts.

Air France-KLM was formed in 2004, following the merger between Air France and KLM. Flying Blue is their loyalty program, also used by Aircalin, Kenya Airways, TAROM, and Transavia.

Last week, the airline group started notifying Flying Blue customers of suspicious activity on their accounts, saying that some of their personal information might have been compromised during the incident.

“Our security operations teams have detected suspicious behavior by an unauthorized entity in relation to your account. We have immediately implemented corrective action to prevent further exposure of your data,” the notification reads.

Potentially compromised data includes names, phone numbers, email addresses, Flying Blue numbers and level, miles balance, and last transaction.

According to Air France-KLM, no credit card data or payment information was exposed during the incident.

The airline company told the impacted customers that it has locked them out of their accounts and instructed them to reset their passwords. The notifications instruct users to go to the Air France/KLM websites to reset their passwords.

Responding to a customer inquiry on Twitter, KLM’s support team confirmed the incident.

“I’ve checked this for you and rest assured that the attack was blocked in time and no miles were charged. I do however invite you to change your Flying Blue-password via the Flying Blue-website,” a KLM employee said.

It’s unclear if hackers penetrated the company’s systems or if the customer accounts were accessed as a result of credential stuffing attacks, which are not uncommon these days.

SecurityWeek has emailed KLM for an official statement on the incident and will update this article as soon as a reply arrives.

Related: Breached American Airlines Email Accounts Abused for Phishing

Related: Cyberattack Steals Passenger Data From Portuguese Airline

Related: Ransomware Attack on Aviation Services Firm Swissport Leads to Flight Delays

Written By

Ionut Arghire is an international correspondent for SecurityWeek.

Click to comment

Expert Insights

Related Content

Cybercrime

Zendesk is informing customers about a data breach that started with an SMS phishing campaign targeting the company’s employees.

Cybercrime

The release of OpenAI’s ChatGPT in late 2022 has demonstrated the potential of AI for both good and bad.

Cybercrime

A new study by McAfee and the Center for Strategic and International Studies (CSIS) named a staggering figure as the true annual cost of...

Cybercrime

The FBI dismantled the network of the prolific Hive ransomware gang and seized infrastructure in Los Angeles that was used for the operation.

Cybercrime

Video games developer Riot Games says source code was stolen from its development environment in a ransomware attack

Cybercrime

CISA, NSA, and MS-ISAC issued an alert on the malicious use of RMM software to steal money from bank accounts.

Cybercrime

Chinese threat actor DragonSpark has been using the SparkRAT open source backdoor in attacks targeting East Asian organizations.

Cybercrime

Artificial intelligence is competing in another endeavor once limited to humans — creating propaganda and disinformation.