--- title: "Iberia Airlines data breach: What customers need to know" description: Spain's flag carrier Iberia Airlines disclosed a significant data security incident in November 2025 that should put all customers on high alert. The breach, which occurred through a compromised third-party supplier, has exposed personal information and created new risks for travelers who have flown with the airline. canonical_url: https://www.acronis.com/en/blog/posts/iberia-airlines-data-breach-what-customers-need-to-know/ locale: en last_updated: 2026-10-27 --- [Acronis Blog](https://www.acronis.com/en/blog/) # Iberia Airlines data breach: What customers need to know Spain's flag carrier Iberia Airlines disclosed a significant data security incident in November 2025 that should put all customers on high alert. The breach, which occurred through a compromised third-party supplier, has exposed personal information and created new risks for travelers who have flown with the airline. [Try now](https://www.acronis.com/en/products/cyber-protect/trial/) [![Image 2: Lee Pender](https://staticfiles.acronis.com/images/content/96b4b6d9ceee3c624b79f42543d1d633.png)](https://www.acronis.com/en/blog/authors/lee-pender/ "Lee Pender") [Lee Pender,](https://www.acronis.com/en/blog/authors/lee-pender/)Senior Content Marketing Manager 3 min read Last updated 27 November 2025 Spain's flag carrier Iberia Airlines disclosed a significant data security incident in November 2025 that should put all customers on high alert. The breach, which occurred through a compromised third-party supplier, has exposed personal information and created new risks for travelers who have flown with the airline. ## What happened in the Iberia cyberattack Iberia [detected unauthorized access to systems](https://www.bleepingcomputer.com/news/security/iberia-discloses-customer-data-leak-after-vendor-security-breach/) belonging to one of its suppliers, which led to the compromise of customer data. The airline [began notifying affected passengers](https://www.infosecurity-magazine.com/news/iberia-airlines-supply-chain-data/) over a weekend in late November 2025, explaining that despite its security measures, attackers gained access to certain personal information. The compromised data may include customer names, email addresses and Iberia Club loyalty card identification numbers. The good news is that account login credentials, passwords and financial details like banking or credit card information were not accessed. The timing of the disclosure is notable. About a week before Iberia's customer notifications went out, a threat actor claimed on dark web forums to be selling 77 GB of alleged Iberia data for $150,000. While it remains unclear whether this separate data dump is connected to the customer breach, the incident highlights the multiple vulnerabilities facing modern airlines. ## Immediate phishing risks for Iberia customers If you're an Iberia customer, you need to be immediately aware of possible phishing attempts. The compromised information could be used to make follow-on phishing attacks appear legitimate. Cybercriminals now have authentic names, email addresses and loyalty program details that can make fraudulent communications seem convincing. Iberia stated it had no evidence the stolen information is being used fraudulently but urged customers to look out for suspicious communications. Be particularly wary of: * Emails claiming to be from Iberia asking you to verify account information. * Messages requesting password resets or login credential updates. * Communications offering compensation or refunds related to the breach. * Links directing you to websites that look like Iberia's official site but have slightly different URLs. Remember: Phishing attacks can happen at any time, even months after a breach when your guard might be down. Criminals can be patient and sometimes wait for the initial wave of concern to pass before launching their campaigns. ## The critical role of security awareness training The Iberia incident underscores a fundamental truth about modern cybersecurity: human beings remain both the strongest defense and the weakest link. This breach didn't result from Iberia's own systems being compromised directly—it came through a [third-party supplier](https://www.acronis.com/en/blog/posts/the-jaguar-land-rover-cyberattack-a-manufacturing-nightmare-that-could-strike-anyone/). Someone at that supplier organization could have fallen victim to a phishing email, used weak passwords, clicked on a malicious link or failed to recognize warning signs of a cyberattack. [Security awareness training](https://www.acronis.com/en/products/cloud/cyber-protect/security-awareness-training/) for employees is essential. Organizations must invest in comprehensive programs that teach staff to: * Recognize phishing emails and social engineering tactics. * Use strong, unique passwords and multi-factor authentication. * Identify suspicious links and attachments before clicking. * Report potential security incidents immediately. * Understand their role in protecting customer data. The aviation industry presents a particularly complex challenge. Airlines work with numerous third-party providers for everything from catering to IT services to maintenance operations. Each of these partners represents a potential entry point for attackers. When suppliers have access to airline systems or customer data, their security practices directly impact the airline's security posture. Effective security awareness training creates a culture of vigilance. Employees who understand the tactics cybercriminals use are far less likely to fall for them. They become active participants in the organization's security rather than passive targets. This is especially important given that phishing attacks can happen at any time, not just during business hours or peak travel seasons. ## Moving forward Iberia has implemented additional security measures in response to the breach, including requiring verification codes before any changes can be made to customer email addresses. The airline continues to monitor for suspicious activity and is working with [regulators](https://www.acronis.com/en/compliance/) on the ongoing investigation. For customers, the lesson is clear: remain vigilant. Update your passwords, enable multi-factor authentication wherever possible and treat any unsolicited communications with healthy skepticism. And for organizations across all industries, the Iberia breach serves as yet another reminder that cybersecurity is a team effort requiring constant education, awareness and preparation at every level. [Cybersecurity](https://www.acronis.com/en/blog/tags/cybersecurity/) [Ransomware protection](https://www.acronis.com/en/blog/tags/ransomware-protection/) ## Written by ![Image 3: Lee Pender](https://staticfiles.acronis.com/images/content/96b4b6d9ceee3c624b79f42543d1d633.png) Lee Pender Senior Content Marketing Manager Lee was a journalist in the technology industry for 15 years, writing for and managing publications that served both IT and partner audiences. His experience as a corporate content creator includes tenures with an MSP and a provider of tax-compliance services. He writes about a variety of topics for Acronis, including cybersecurity trends, MSP management, emerging technologies and product updates. [Previous post](https://www.acronis.com/en/blog/posts/detect-spyware/) [How to detect spyware?](https://www.acronis.com/en/blog/posts/detect-spyware/) [Next post](https://www.acronis.com/en/blog/posts/how-msps-can-back-up-microsoft-365-for-their-clients/) [How MSPs can back up Microsoft 365 for their clients](https://www.acronis.com/en/blog/posts/how-msps-can-back-up-microsoft-365-for-their-clients/) About Acronis Acronis is a leader in AI-native cyber protection, unifying data protection, cybersecurity, IT operations and hybrid infrastructure to deliver business continuity, security and compliance with less cost and complexity. More than 21,000 service providers trust Acronis to protect over 750,000 businesses in 150 countries. Acronis is headquartered in Schaffhausen, Switzerland. [Add as a preferred source on Google](https://google.com/preferences/source?q=acronis.com) ## Related stories Want to learn more? Read the latest stories featuring this solution on our blog. [Acronis Blog](https://www.acronis.com/en/blog/) ![Image 4: stc Bahrain and Acronis partner to bring advanced endpoint security to businesses in Bahrain](https://staticfiles.acronis.com/images/blog-card/9600f3eea83b8f4e168ea6c1409c8c26.png) [stc Bahrain and Acronis partner to bring advanced endpoint security to businesses in Bahrain](https://www.acronis.com/en/blog/posts/stc-bahrain-and-acronis-partner-to-bring-endpoint-security-to-businesses/) We are proud to announce a strategic partnership with stc Bahrain, expanding access to advanced cybersecurity services for businesses across Bahrain. **October 26, 2026**3 min read ![Image 5: Acronis expands MDR toward broader workspace protection](https://staticfiles.acronis.com/images/blog-card/18e90e89f5ec4ef0901f19008d4ccbf2.png) [Acronis expands MDR toward broader workspace protection](https://www.acronis.com/en/blog/posts/acronis-expands-mdr-toward-broader-workspace-protection/) Acronis is expanding the MDR service with capabilities that make this expertise easier to deliver and help partners address more risks. The developments build on a broader commitment to managed security: helping service providers protect the connected workspace while giving customers access to the expertise needed to investigate threats, respond effectively and maintain business continuity. **October 13, 2026**6 min read ![Image 6: Acronis Cyber Protect v17: Improving cyber resilience across people, data and infrastructure](https://staticfiles.acronis.com/images/blog-card/c2467c28c0278609eb3560cb2a8a4d53.png) [Acronis Cyber Protect v17: Improving cyber resilience across people, data and infrastructure](https://www.acronis.com/en/blog/posts/acronis-cyber-protect-v17-improving-cyber-resilience-across-people-data-and-infrastructure/) Acronis Cyber Protect v17 Q3 2026 expands integrated cyber protection with new capabilities that strengthen security awareness, improve backup operations and extend protection across more virtual environments. The result is stronger cyber resilience, simplified operations and broader protection delivered through a single platform. **October 05, 2026**4 min read