← Transavia

2019 Transavia — 83K passengers, €400K fine

2019 83.0K records affected Share on X

Data compromised

Names, DOB, flight details, booking numbers, medical info

Technical writeup

Hacker used 2 IT employee accounts; downloaded data of 83K passengers (Jan 21-31, 2015 flights). Theoretically 25M accessible. Names, DOB, flight details, booking numbers; 367 had medical/impairment info. Weak passwords, no MFA. €400K AP fine.

Root cause

Compromised employee accounts; weak passwords, no MFA

References