Franco-Dutch airline company Air France-KLM has started informing Flying Blue customers of a data breach involving their user accounts.

Air France-KLM was formed in 2004, following the merger between Air France and KLM. Flying Blue is their loyalty program, also used by Aircalin, Kenya Airways, TAROM, and Transavia.

Last week, the airline group started notifying Flying Blue customers of suspicious activity on their accounts, saying that some of their personal information might have been compromised during the incident.

“Our security operations teams have detected suspicious behavior by an unauthorized entity in relation to your account. We have immediately implemented corrective action to prevent further exposure of your data,” the notification reads.

Potentially compromised data includes names, phone numbers, email addresses, Flying Blue numbers and level, miles balance, and last transaction.

According to Air France-KLM, no credit card data or payment information was exposed during the incident.

The airline company told the impacted customers that it has locked them out of their accounts and instructed them to reset their passwords. The notifications instruct users to go to the Air France/KLM websites to reset their passwords.

Responding to a customer inquiry on Twitter, KLM’s support team confirmed the incident.

“I’ve checked this for you and rest assured that the attack was blocked in time and no miles were charged. I do however invite you to change your Flying Blue-password via the Flying Blue-website,” a KLM employee said.

It’s unclear if hackers penetrated the company’s systems or if the customer accounts were accessed as a result of credential stuffing attacks, which are not uncommon these days.

SecurityWeek has emailed KLM for an official statement on the incident and will update this article as soon as a reply arrives.

By Ionut Arghire on Mon, 09 Jan 2023 14:15:05 +0000
Original link