Third-party breach compromises Iberia data

Iberia, Spain's flag carrier, has confirmed having been impacted by a third-party breach following a threat actor's assertions of having stolen 77 GB of its data, according to Security Affairs.

Infiltration of the third-party supplier's systems enabled the potential theft of Iberia customers' names, email addresses, or loyalty card identification numbers, but not their accounts, credentials, or financial information, said Iberia in breach notices provided to affected individuals. Investigation into the incident is still ongoing but there has been no evidence so far indicating data misuse.

Iberia's disclosure comes as its data has been offered by threat actors to competitors and Chinese or Russian threat actors for $150,000. Allegedly included in the 77 GB data trove were AMP maintenance files, technical details on A320 and A321 aircraft, engine information, and internal documents with certificates and signatures, according to Hackmanac, who noted that the attackers claimed the data to have ISO 270001 certification and ITAR classification.