Cyprus Airways, the flag carrier of Cyprus, has allegedly fallen victim to a significant data breach, with threat actors claiming to possess and be selling a vast trove of sensitive passenger and operational data. The airline, a key player in connecting Cyprus with Europe and the Middle East, handles substantial amounts of personal and travel information, making this alleged incident a serious concern for customer privacy and aviation security.
According to a post on an online forum, the attackers claim to have exfiltrated 45GB of data. This allegedly includes information on all flights from 2018 to June 3, 2025, encompassing 1.5 million Passenger Name Records (PNRs) and 2.3 million electronic tickets. The forum post further asserts that the cybercriminals have ongoing access to the airline’s systems, allowing them to view arriving and departing passenger information in real-time. Details of 12 authorized personnel within the airline, including their names, email addresses, and phone numbers, are also allegedly part of the compromised data set.
The threat actors are reportedly offering the extensive dataset for sale. The types of passenger information allegedly compromised include:
- Passenger e-mail
- Passenger name
- Passenger surname
- Travel date
- Amount paid
- Document information
- Phone number
- Passenger data (41GB)
- Electronic Ticket (ET) data (2GB)
