airBaltic reports unauthorised access to passenger data at external IT provider

Latvian airline airBaltic announced on 15 November a data security incident: unauthorised access was detected in the systems of its external IT service provider, involving passengers' online check-in data. The airline's own IT systems were not affected. The case matters to travellers because the exposed details could in theory be used for fraud.

What was affected

According to current information, roughly 618,000 passenger name records (PNR), or bookings, are involved. They belong to people who checked in online for airBaltic flights between 18 July and 12 November. The accessed data include passengers' names and surnames, booking reference numbers and flight information. Payment data, travel document data and other sensitive information were not affected. So far there are no signs that the data have been misused.

Measures taken

About 11,800 of the affected bookings include flights that have not yet taken place; this figure may change as the investigation proceeds. To protect active bookings from unauthorised access and changes, the company has disabled booking management and online check-in for them. Affected passengers can check in at the airport free of charge. For all other passengers, online services work as usual. Flights are running according to schedule, and all passengers can travel as planned.

Fraud warning

The airline notes that the information could potentially be used in fraudulent messages that appear to come from airBaltic or other travel providers, or in attempts to access and alter bookings. Passengers are urged to be cautious about unexpected emails, text messages or calls related to their booking, including messages offering compensation or a refund for a flight.

Investigation

Both airBaltic and the service provider have notified the relevant supervisory authorities, including CERT.LV. The investigation into the circumstances continues. Passengers with questions can write to the company's data protection officer at gdpr@airbaltic.com.