Ransomware Attack Exposes Over 6 Million TAP Air Portugal Customer Records
What Happened
In August 2022, TAP Air Portugal was hit by a ransomware intrusion linked to the Ragnar Locker gang. The attackers exfiltrated and later posted a data set covering 6,083,479 customer accounts, revealing names, dates of birth, email addresses, phone numbers, physical addresses, genders, nationalities, salutations and spoken languages.
Why It Matters for Compliance & Audit Readiness
- Illustrates the necessity of continuous control‑assurance that validates encryption, access‑control and data‑retention policies for any system storing personally identifiable information (PII).
- Reinforces the requirement to keep auditable evidence of third‑party risk assessments and contractual security clauses, especially when SaaS or API integrations expose customer data.
- Drives the need for tested incident‑response and breach‑notification playbooks that satisfy GDPR, PCI‑DSS and other regulatory timelines.
Who Is Affected
- Aviation and travel service providers
- Organizations that integrate with TAP’s booking, loyalty or API platforms
- Approximately 6 million individuals whose personal data resides on the flytap.com domain
Recommended Actions
- Review any data‑sharing agreements or API connections with TAP Air Portugal and assess potential exposure of your own customers.
- Validate that monitoring controls (UEBA, DLP, SIEM alerts) are capturing access to PII and that alerts are triaged within defined SLAs.
- Request TAP’s incident‑response disclosure and remediation evidence; document the response for audit trails and risk registers.
Technical Notes
- Attack vector: Ransomware payload delivered via compromised credentials; data exfiltration followed by public leak on a dark‑web site.
- CVE(s): None disclosed in public reports.
- Data types exposed: Dates of birth, email addresses, genders, names, nationalities, phone numbers, physical addresses, salutations, spoken languages.
Source: https://haveibeenpwned.com/api/v3/breach/TAPAirPortugal