Madrid, Spain – Spanish airline Air Europa disclosed a data breach affecting an unknown number of customer credit cards used to make flight bookings on its website, according to a company statement released on Tuesday, October 10, 2023.
The airline said it recently discovered unauthorized access to its online e-commerce platform that processes credit card payments but did not provide details on when the cyberattack occurred or the extent of the breach.
“Air Europa has contacted the customers whose data may have been accessed and the relevant financial institutions, and is working with the utmost transparency to manage communications and implementations derived from this incident,” the company statement said.
This latest payment system breach follows a prior 2018 incident acknowledged by Air Europa in which the personal data of 489,000 customers was compromised. The Spanish data protection agency fined the airline €700,000 ($693,000) in 2021 for failing to promptly report the earlier hack within the required 72 hours.
According to the statement, Air Europa said it has reinforced security protocols around its websites and e-commerce platforms after detecting the new breach. The incident has also been reported to relevant data protection authorities.
The airline advised customers whose card information may have been stolen to immediately cancel the cards and request replacements from their banks. There was no evidence provided of current financial fraud related to the stolen payment data.
The breach comes as Air Europa is in the process of an acquisition by the International Consolidated Airlines Group (IAG), owner of British Airways and Iberia. The €1 billion ($980 million) deal is still undergoing final regulatory review but is expected to be completed soon.
In its statement, Air Europa did not provide any details about how its payment system was compromised or confirm when impacted customers would be notified. Major data breaches often involve class action lawsuits and substantial costs for forensic investigation and victim compensation.