Air France-KLM suffered a data breach on the night of 6 to 7 August 2025, exposing some customers’ personal information through a compromised external provider. The cyberattack, attributed to the ShinyHunters group, is part of a vast campaign targeting the Salesforce instances of major companies worldwide.
The airline reacted immediately by securing the breach and notifying the authorities, while reassuring customers that no sensitive financial data had been compromised. However, the Air France data breach raises important questions about the security of external providers and the risk of targeted phishing for travellers.
Details of the Air France data breach
The origin of the attack
The Air France data breach originated from fraudulent access to a third-party system used by Air France-KLM’s contact centres. Security teams detected unusual activity on this external platform dedicated to customer relationship management (CRM).
Rather than attacking Air France’s infrastructure directly, the cybercriminals exploited a weakness at an external provider. This increasingly common strategy lets attackers bypass the main defences by targeting weaker links in the digital supply chain.
The attackers’ modus operandi
According to analyses by BleepingComputer and reports from Google Threat Intelligence, the Air France data breach is part of a large-scale campaign run by the ShinyHunters group. The cybercriminals use vishing (voice phishing) techniques to deceive employees of companies that use Salesforce.
The method consists of posing as IT support staff in phone calls and convincing victims to authorise a malicious version of the Salesforce Data Loader app. Once they have access, the attackers can exfiltrate data stored in the CRM instances on a massive scale.
Data compromised in the Air France breach
Exposed information
The Air France data breach exposed several categories of personal information:
Contact data:
- Customers’ surnames and first names
- Email addresses
- Various contact information
Loyalty programme data:
- Flying Blue numbers
- Loyalty tiers
- History of exchanges with customer service
Customer communications:
- Subject lines of requests sent by email
- Content of previous contacts with customer service
- Various complaints and requests
Protected data that was not compromised
Air France-KLM reassured customers that several categories of sensitive data were not affected by the Air France data breach:
Financial data:
- Credit card numbers
- Banking information
- Payment data
Travel data:
- Booking information
- Travel data
- Flying Blue miles balances
Identification data:
- Customer account passwords
- Passport numbers
- Identity documents
This limited damage reflects appropriate data segmentation at Air France, which prevented access to the most critical information.
Air France in ShinyHunters’ sights
A large-scale campaign against Salesforce
The Air France data breach is part of a vast campaign orchestrated by ShinyHunters that specifically targets Salesforce customers. Since the start of 2025, several large companies have suffered similar attacks:
Confirmed victims:
- Google (SMB data compromised)
- Adidas (customer service tickets)
- Pandora (customer profiles)
- Qantas (CRM passenger data)
- LVMH and its subsidiaries (Louis Vuitton, Dior, Tiffany & Co)
- Allianz Life (1.4 million customers)
The ShinyHunters method
The ShinyHunters group has industrialised its attacks against Salesforce environments. Its approach combines in-depth reconnaissance, sophisticated social engineering and the abuse of legitimate tools.
In the case of the Air France data breach, the attackers probably followed the same process:
- Reconnaissance of the target organisation and its providers
- Vishing calls to employees of the CRM provider
- Installation of a compromised version of the Salesforce Data Loader
- Exfiltration of Air France customer data
- Preparation of possible extortion attempts
The risks for Air France customers
Targeted phishing threats
Although the data compromised in the Air France breach cannot be used to buy tickets or access customer accounts, it is a valuable basis for sophisticated phishing attacks.
Possible attack scenarios:
- Fraudulent emails mentioning recent flights or genuine complaints
- Text messages supposedly from Air France about refunds
- Phone calls from scammers posing as customer service
- Exclusive offers exploiting victims’ Flying Blue status
Social engineering techniques
Cybercriminals can use the information stolen in the Air France data breach to personalise their attacks:
Greater credibility: using the exact name, Flying Blue number and references to real exchanges with customer service to make fraudulent messages more credible.
Manufactured urgency: creating urgent scenarios (a problem with a booking, an urgent refund) to push victims to act quickly without thinking.
Contextual exploitation: using the summer holiday period to offer exceptional deals or travel-related security alerts.
Air France’s response to the data breach
Immediate measures taken
Following the Air France data breach, the airline quickly put in place a series of corrective measures:
Technical security:
- Immediate closing of the access breach
- Stronger protection measures at the provider
- In-depth security audit of third-party systems
Customer communication:
- Personalised notification of all affected customers
- Email alerts detailing the data concerned
- Security advice and vigilance recommendations
Regulatory compliance
Air France-KLM met its legal obligations regarding the Air France data breach:
Notification of the authorities:
- Report to the CNIL (the French data protection authority) in France
- Notification of the Dutch Data Protection Authority for KLM
- Compliance with the 72-hour deadline set by the GDPR
Customer transparency:
- Proactive communication with affected customers
- Publication of detailed information about the nature of the incident
- Customer service available to answer questions
Lessons learned and improvements
The Air France data breach revealed the importance of external provider security. The airline announced it was strengthening its security requirements for all its digital service providers.
How to protect yourself after the Air France breach
Vigilance against suspicious communications
Following the Air France data breach, customers should be extra vigilant about communications:
Warning signs:
- Unsolicited emails or text messages mentioning recent flights
- Requests for personal information by phone
- Suspicious links to supposed Air France sites
- Exclusive offers that are too good to be true
Systematic checks:
- Check the sender’s email address
- Check links before clicking (hover to see the URL)
- Contact Air France customer service directly via the official site if in doubt
Personal protection measures
Stronger passwords: although Air France says passwords were not compromised in this data breach, it is still advisable to change your Flying Blue account password as a precaution and use a unique, complex password.
Enable two-factor authentication: turn on two-factor authentication on your Flying Blue account and all your other online accounts to add an extra layer of security.
Account monitoring:
- Check your bank statements regularly
- Monitor your Flying Blue account activity
- Report any suspicious transaction immediately
Actions recommended by Air France
The airline specifically recommends that customers:
If a communication seems dubious:
- Never respond immediately to requests for information
- Check authenticity before taking any action
- Contact customer service directly if necessary
Reporting incidents:
- Report any suspicious email or call to Air France customer service
- Alert the authorities in the event of an actual scam attempt
- Share the information with those around you to prevent other victims
The impact of the Air France breach on the airline sector
A particularly targeted sector
The Air France data breach is part of a worrying trend affecting the airline industry. In less than two months, three major airlines suffered cyberattacks:
Recent incidents:
- Air France-KLM (August 2025): data breach via a CRM provider
- Qantas (June 2025): passenger data compromised
- Aeroflot (July 2025): cyberattack that led to dozens of flights being cancelled
The sector’s vulnerabilities
Airlines have several characteristics that make them attractive targets:
Rich data:
- Detailed personal information about travellers
- Location data and travel habits
- Financial and payment information
Complex systems:
- Large numbers of external providers
- Multiple interconnections between systems
- Legacy technologies
Media impact:
- International brand visibility
- Public sensitivity to security issues
- High potential for reputational blackmail
The security challenges of external providers
The weak link in the chain
The Air France data breach perfectly illustrates the risks of outsourcing critical services. The compromised CRM provider is a prime entry point for attackers seeking to access large companies’ data.
Security challenges:
- More access points to secure
- Limited control over third parties’ practices
- Complexity of continuous risk assessment
New security requirements
Following the Air France data breach and similar attacks, companies are tightening their requirements for providers:
Stronger assessment:
- Regular security audits of providers
- Mandatory certification for critical suppliers
- Strict contractual clauses on data protection
Continuous monitoring:
- Real-time monitoring of third-party access
- Automatic alerts on suspicious behaviour
- Periodic review of access rights
The evolving ShinyHunters threat
Increasingly professional attacks
The Air France data breach shows how the ShinyHunters group is moving towards increasingly sophisticated attack methods. Its ability to run coordinated campaigns against multiple targets reveals a worrying level of professionalisation.
Characteristics of this evolution:
- Coordinated targeting of a sector (Salesforce customers)
- Refined social engineering techniques
- A shift from reselling data to direct extortion
Law enforcement response
The authorities are stepping up efforts to dismantle these criminal networks:
Recent actions:
- Arrest of suspected ShinyHunters members in France (June 2025)
- Stronger international cooperation
- Information sharing between victim companies
Recommendations for businesses
Lessons from the Air France breach
This cyberattack offers several important lessons for companies that use external providers:
Securing the supply chain:
- Systematic audits of all providers with access to data
- Strict, segmented access controls
- Stronger employee training on vishing techniques
Crisis management preparedness:
- Ready-to-use incident response plans
- Procedures for notifying the authorities
- Transparent customer communication strategies
Recommended preventive measures
Technical security:
- Mandatory multi-factor authentication for all sensitive access
- Real-time monitoring of suspicious activity
- Encryption of sensitive data in transit and at rest
Training and awareness:
- Regular awareness programmes on social engineering techniques
- Phishing and vishing attack simulations
- Clear identity verification procedures for sensitive requests
The future of cybersecurity in aviation
Challenges ahead
The Air France data breach foreshadows the cybersecurity challenges the airline sector will face in the coming years:
More complex threats:
- Growing use of artificial intelligence by attackers
- Increasingly sophisticated social engineering techniques
- Ever more precise targeting of sector-specific vulnerabilities
Regulatory changes:
- Stronger security obligations for providers
- International harmonisation of cybersecurity standards
- Heavier penalties for negligence
Security innovation
To meet these challenges, the sector is investing heavily in new protection technologies:
Emerging technologies:
- Artificial intelligence for anomaly detection
- Blockchain to secure data exchanges
- Advanced biometric authentication
Although its immediate consequences were contained, the Air France data breach is a reminder of the need for constant vigilance as cyber threats evolve. Protecting customer data remains a major issue for maintaining trust in a sector where security is paramount, in the air as well as in cyberspace.
Air France data breach: frequently asked questions
The Air France data breach exposed customers’ surnames, first names, email addresses, Flying Blue numbers, loyalty tiers and the subject lines of exchanges with customer service. Passwords, banking data and travel information were not compromised.
Air France is contacting all affected customers personally by email. If you are affected by this data breach, you will receive a direct notification from the airline with details of the incident.
The Air France data breach is attributed to the ShinyHunters cybercriminal group, which compromised an external Air France provider specialising in customer relationship management (CRM).
The main risks include targeted phishing attempts using your personal information, fake emails or text messages posing as Air France, and fraudulent calls exploiting your stolen data.
Be wary of suspicious communications, never click dubious links, check that messages are genuine before replying and contact Air France customer service directly if in doubt.
The incident was reported to the CNIL in accordance with the GDPR. The authorities will assess whether security procedures were breached to determine any penalties.
Leave a Reply