Spanish airline Iberia is facing a $6 million ransom demand after the Everest ransomware group claimed to have stolen nearly 600 gigabytes of passenger data from a third-party vendor. The compromised files reportedly include names, email addresses, birth dates and travel histories, though no complete credit card numbers were accessed.
Iberia confirmed that its Iberia Club loyalty accounts were affected and began notifying members on Sunday. The airline says there is no sign of fraudulent activity yet, but is urging customers to stay alert for phishing attempts.
Everest has issued threats on the dark web, warning that the stolen data could fuel widespread fraud if released. The same group was linked to cyberattacks on major European airports in September, underscoring growing cybersecurity risks across the aviation sector.
Regulators are now reviewing the incident as Iberia’s security teams work to contain the breach.