On 23 November 2025, Iberia disclosed a security incident stemming from an unauthorized access to the systems of a third-party supplier / vendor.The airline communicated to impacted customers that certain personal data may have been exposed. According to the notification, exposed information may include first and last name, email address, and loyalty-card identification numbers (Iberia Club). Iberia explicitly stated that account login credentials/passwords and payment card or banking data were not compromised.
Scope & Context
- The disclosure came shortly after a threat actor on a hacker forum claimed to possess 77 GB of data allegedly extracted from Iberia, offered for sale for USD 150,000. The claimed contents included not only customer data, but also technical documentation related to aircraft maintenance, engine data, internal operational documents.
- Iberia confirmed the leak originates from a supplier breach, not from its own core systems. The vendor’s identity and the specific systems affected have not been publicly disclosed.
- The airline began customer notifications shortly after the public claim — a number of days after the alleged theft — but no specific date for the initial compromise has been revealed.
Attack Classification & Technical Attribution
- The incident aligns with a supply-chain/vendor compromise scenario, where adversaries target external suppliers rather than the primary organization directly.
- According to one public analysis, the attacker may have leveraged techniques mapped to the following in the MITRE ATT&CK framework:
- T1195 (Supply Chain Compromise) — compromise of a vendor/supplier to reach primary victim.
- T1567.002 (Exfiltration Over Web Service) — exfiltration of data from the compromised environment to an external location.
- Some unconfirmed public commentary suggests that the attacker might have exploited a public-facing application or used valid/stolen credentials to gain access to the supplier’s infrastructure (e.g., references to techniques similar to T1078 (Valid Accounts) or T1190 (Exploit Public-Facing Application) in some analyses.
- However — and this is important for clarity — no concrete forensic indicators (e.g., malware samples, hashes, C2 infrastructure, exploit details) have been published. The information about method of initial access remains speculative. The supplier name, system names, and logs have not been publicly disclosed either.
Confirmed Data Exposure
- The only confirmed exposed data elements are customer names, email addresses, and Iberia Club loyalty-card IDs.
- Credentials (user passwords) and financial/payment-card data were confirmed not compromised as per pentesting experts.
- There is no official confirmation that the larger 77 GB data package claimed for sale — containing internal documents and aircraft maintenance data — overlaps fully with the data Iberia has admitted was exposed.
Threat Actor & Motivation
- The identity of the threat actor remains unknown; no public attribution has been made.
- The actor publicly advertised the data for monetary gain (USD 150,000), positioning it as suitable for resale, espionage, or sale to state-actors.
- The claimed dataset—that includes alleged internal technical and operational documentation—would be of interest for competitor intelligence, industrial espionage, or supply-chain-targeted threat scenarios.
The breach affecting Iberia appears to be a classical case of supply-chain compromise: an external vendor’s systems were breached, leading to unauthorized exfiltration of customer information (names, emails, loyalty-card IDs). The airline confirmed no loss of credentials or payment data. A threat actor apparently claims to have much larger data — including technical/operational documents — but that portion remains unverified. No technical forensic data has been released, and the attack vector remains unspecified. As it stands, the publicly available facts are limited and largely consist of the customer notification, statements by Iberia, and the threat actor’s forum listing.
Information security specialist, currently working as risk infrastructure specialist & investigator.
15 years of experience in risk and control process, security audit support, business continuity design and support, workgroup management and information security standards.