Loading story…
Iberia, Spain's largest airline and a member of the International Airlines Group (IAG), has disclosed a data breach affecting customer information following a security incident at one of its third-party suppliers. The breach was revealed after a threat actor claimed on hacker forums to possess 77 GB of data allegedly stolen from the airline. Exposed data includes customer names, email addresses, and Iberia Club loyalty card identification numbers. Iberia has confirmed that no account passwords or financial information were compromised in the incident.
Upon discovering the breach, Iberia activated its security protocols, implemented additional technical and organizational measures, and notified relevant authorities. The airline has also enhanced protections around customer email addresses, now requiring verification codes for changes, and is monitoring its systems for suspicious activity. Customers have been advised to remain vigilant for suspicious communications and to report any anomalous activity. The investigation is ongoing in coordination with the affected supplier, and as of the latest update, there is no evidence of fraudulent use of the compromised data.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
Following the disclosure, Iberia said it activated security protocols, strengthened protections, increased monitoring, and notified relevant regulators. The company also stated it had found no evidence of fraudulent use of the exposed data and advised customers to remain vigilant.
Iberia disclosed that a security incident at a third-party supplier exposed customer data including names, email addresses, and Iberia Club loyalty IDs. The airline said passwords and financial information were not affected.
A threat actor claimed to possess 77 GB of data tied to Iberia and offered it for sale for $150,000. The allegedly stolen material reportedly included internal technical documents, maintenance files, engine data, and other sensitive records obtained through a compromised third-party supplier.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The Everest ransomware group has claimed responsibility for significant cyberattacks against Iberia, Spain's national airline, and Air Miles España, the operator of the Travel Club rewards program. In these incidents, Everest reportedly exfiltrated 596 GB of sensitive data from Iberia, including personal and payment information, loyalty details, travel histories, and booking-related communications for millions of customers across multiple countries. The attackers also claim to have had the ability to manipulate bookings, such as changing contact details, modifying seats, and cancelling tickets, posing a severe risk to passenger data security and operational integrity. For Air Miles España, Everest claims to have stolen approximately 131 GB of data and locked internal systems, following a double extortion model where files are both stolen and systems encrypted to pressure for ransom payment. The breaches have raised significant concerns about identity theft, phishing, and regulatory compliance, particularly under GDPR, given the scale and sensitivity of the compromised data. The Everest group has threatened to leak the stolen information if negotiations with the affected organizations fail, a tactic consistent with their previous operations. The attacks highlight a growing trend of ransomware groups targeting high-profile entities in the travel and rewards sectors, with potential impacts extending to millions of individuals and business partners in Spain, Latin America, and other regions where Iberia and Travel Club operate.
Jun 29, 2026
Basic-Fit disclosed a breach affecting about **200,000 customers in the Netherlands** after unauthorized access allowed attackers to download personal data before the intrusion was stopped. The exposed information included membership details, names, addresses, email addresses, phone numbers, dates of birth, and **bank account details**. The company said it notified affected customers and reported the incident to the Dutch Data Protection Authority, while media reports indicated the wider impact may extend beyond the Dutch customer base and raised questions about controls that failed to prevent large-scale data exfiltration. Booking.com also warned customers that unauthorized third parties may have accessed reservation-related information after suspicious activity was detected on a number of bookings. The potentially exposed data included customer names, email addresses, phone numbers, and other booking details submitted during the reservation process. Booking.com said the full scope of the incident remains under investigation, reset PIN codes tied to affected reservations, and urged customers to watch for suspicious activity and phishing attempts leveraging the stolen information.
Jun 29, 2026
**Endesa** (Enel Group) disclosed unauthorized access to its *Energía XXI* commercial platform, resulting in exposure of customer contract-related personal and financial data. Impacted data types reported include **identification and contact details**, **Spanish national identity numbers (DNI)**, **contract information**, and **payment details including IBANs**; Endesa stated that **account passwords were not exposed** and that there was **no evidence of fraudulent use** at the time of notification. Endesa reported taking containment and investigation steps including **blocking access to compromised internal accounts**, collecting and analyzing logs, and increasing monitoring for suspicious activity while notifying affected customers. The incident was reported to Spanish authorities including the **Spanish Data Protection Agency (AEPD)** and referenced coordination with national cybersecurity bodies; reporting also noted an attacker claim of large-scale SQL data theft and attempted sale on a dark web forum, though Endesa’s public statements emphasized the breach was limited to customer data access and did not involve operational disruption or ransomware.
Jun 29, 2026