Loading story…
The Airlines Reporting Corporation (ARC), owned by eight US airlines, has made at least five billion passenger records available to US government agencies via a searchable database. This data, collected from over 12,800 travel agencies and 270 global carriers, includes names, itineraries, and financial details, and is sold under the Travel Intelligence Program. The scale of data sharing is significantly larger than previously reported, raising ongoing privacy concerns.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
Initial story creation
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The Airlines Reporting Corporation (ARC), a data broker owned by major airlines, has announced it will discontinue its Travel Intelligence Program (TIP), which sold hundreds of millions of customer travel records to US government agencies. This decision follows a letter from ARC's CEO to lawmakers, prompted by bipartisan pressure after revelations that the Internal Revenue Service (IRS) accessed ARC's extensive travel database without a warrant, violating federal law and agency policy. The database included detailed information on individuals' flight itineraries and credit card transactions, covering approximately 722 million ticket transactions over a 39-month period. Lawmakers criticized ARC for enabling 'prospective surveillance' by allowing government agencies to set up automated alerts for new matching reservations, effectively bypassing higher legal standards for monitoring future activity. The controversy intensified after it was revealed that the IRS did not conduct a privacy impact assessment or legal review before purchasing the data. ARC's move to halt the TIP comes amid ongoing scrutiny over the privacy implications of selling such sensitive travel data to government entities without adequate oversight or legal safeguards.
Jun 29, 2026
Sen. Ron Wyden and Rep. Shontel Brown asked the Government Accountability Office to investigate whether the Department of Transportation has failed for more than four decades to enforce airline passenger-data privacy protections. Their request cites allegations that Airlines Reporting Corporation, an airline-owned data broker, sold federal agencies access to roughly 722 million passenger travel records without warrants or court oversight, alongside reports of DEA traveler profiling and payments to airline employees for private passenger information. The lawmakers said DOT has not publicly brought privacy-enforcement cases or issued civil penalties despite major incidents affecting hundreds of millions of travelers. They also requested scrutiny of DOT's oversight model and coordination with the DEA, and asked GAO to determine the status, findings, and any enforcement outcomes from the department's March 2024 review of data-collection and use practices at the 10 largest U.S. airlines, whose responses and results have not been publicly released.
Aug 27, 2026
A misconfigured, publicly accessible development server operated by regional airline **CommuteAir** exposed an outdated 2019 version of the U.S. **no-fly list** along with personal information for roughly 900 employees. The exposure was reportedly discovered by Swiss hacker **maia arson crimew**, who found a file named `NoFly.csv` containing more than 1.5 million records, including names and birth dates of people identified as having suspected ties to terrorist organizations; reports noted the total was likely inflated by aliases and duplicate-style entries. CommuteAir confirmed the database was legitimate, took the server offline, and said it reported the incident to the **Cybersecurity and Infrastructure Security Agency**. The leaked file was described as a subset of the broader U.S. **Terrorist Screening Database** maintained by the DOJ, FBI, and Terrorist Screening Center, and the disclosure renewed criticism from civil liberties advocates who argue the watchlisting system is opaque, error-prone, and disproportionately affects Muslims and people of Arab, Middle Eastern, or South Asian descent.
Jun 29, 2026