Iberia discloses security incident tied to supplier breach

Iberia warned customers of a data breach linked to a supplier, after a third‑party provider was hacked, with the incident exposing some customer information such as names, emails and Iberia Club loyalty IDs. A threat actor claims to be selling 77 GB of Iberia’s internal data for 150,000 dollars, according to Hackmanac.

The airline says the attacker did not gain access to Iberia accounts or customer passwords, and it has applied security measures, increased monitoring, and notified regulators while continuing to investigate with the supplier. The materials allegedly up for sale include technical data on aircraft such as the A320 and A321, AMP maintenance files, engine data, and internal documents bearing signatures and certificates, with some claims suggesting ISO 27001 and ITAR classifications.

Iberia states it activated its security protocol immediately after learning of the supplier breach and is urging customers to remain vigilant for suspicious messages. The company reports no evidence of fraudulent data use so far, but emphasises ongoing cooperation with the supplier and regulators as the investigation continues.