Bourse des Vols Data Breach Exposes 1.46 M Customer Records Including Travel Histories
What Happened – In January 2021 the French travel‑booking platform Bourse des Vols suffered a data breach that released 1,460,130 unique records. The leak comprised over 9 GB of data spread across more than 1,200 SQL files, revealing personal identifiers, contact details, IP addresses, dates of birth, and detailed travel histories (flights taken and purchases).
Why It Matters for Trust & Control Assurance
- Demonstrates the need for continuous privacy‑control monitoring and evidence that personal data is protected in‑flight and at rest.
- Highlights gaps in data‑handling policies that must be documented to satisfy audit‑readiness and defensible evidence requirements.
- Directly tests the control objective of “protecting personal data and ensuring lawful processing,” a core element across many compliance frameworks.
Who Is Affected – Travel‑booking services, online retailers handling consumer travel data, and any organization processing EU personal data.
Recommended Actions
- Map the breach to your privacy‑control objectives (e.g., data classification, consent management, DSAR processes) and collect supporting evidence.
- Review and harden access controls around databases storing personal and travel information; implement continuous monitoring for unauthorized extraction.
- Update incident‑response playbooks to include rapid notification, containment, and forensic analysis for data‑exfiltration events.
Technical Notes – Exposed data types: names, email addresses, phone numbers, physical and IP addresses, dates of birth, flight itineraries, and purchase histories. The breach was disclosed via Have I Been Pwned (HIBP) without a publicly identified attack vector. Source: https://haveibeenpwned.com/api/v3/breach/BourseDesVols