Cyprus Airways has warned customers of a potential personal data breach following a phishing attack that gave unauthorised access to passenger information.
The airline said in an email to customers that an unauthorised external party recently gained access to a passenger file through credential phishing, though there was no breach of the company’s servers or electronic infrastructure.
The potentially affected data does not include passwords, credit card details or any payment-related information, according to the company. However, it primarily concerns contact details of customers who had made flight bookings in the past.
The data that may have been leaked to third parties includes full names, identity or passport numbers, email addresses, telephone numbers, flight numbers and routes, as well as fare types.
Company sources told Phileleftheros that the airline managed to stop the attack, meaning passenger lists were not fully compromised.
Cyprus Airways warned passengers that contact details could potentially be used to send misleading or malicious phishing messages appearing to come from the airline or related entities.
The company advised customers to be particularly careful with emails or messages requesting personal or financial information, always check sender addresses, and avoid opening suspicious links or attachments.
The airline said passenger privacy protection and data security remain its highest priority. Upon immediate notification of the incident, Cyprus Airways took immediate measures to investigate the incident, identify the compromised account and analyse systems.
These actions included further strengthening security measures.
