air europa Listed by incransom Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

People who have flown with Air Europa, booked through its channels, or otherwise shared personal details with the airline may now face uncertainty about whether their information sits among files claimed to have been taken. Public reporting does not yet confirm how many individuals are involved or exactly which records left the company’s systems, but the listing of the airline by a ransomware group raises practical questions about privacy, fraud risk, and what customers should watch for next.

On 29 January 2025 the group known as incransom listed Air Europa on its leak site and asserted that internal files had been exfiltrated. The group further claimed to hold “a lot of clients private information.” The number of people affected remains unknown, and independent confirmation of the full scope has not been published. For ordinary travellers and staff, the immediate concern is whether their data is among what the attackers say they possess.

What happened

According to the available record, Air Europa was listed by the incransom ransomware group on 29 January 2025. The listing describes an attack in which internal files were allegedly exfiltrated. The group’s own statement on the matter includes the assertion that it holds a substantial volume of clients’ private information. No public figure has been given for the number of people affected, and details of the initial intrusion method, the precise date the systems were compromised, or the volume of data removed have not been disclosed in the facts available. The incident is therefore known primarily through the group’s leak-site claim rather than through a detailed official disclosure.

The group behind it: incransom

Incransom is a ransomware operation that follows the now-common double-extortion model: encrypting systems while also stealing data and threatening to publish it if a ransom is not paid. Like other groups of this type, it maintains a public leak site on which it names victims and, in some cases, releases sample files or full archives. The group’s listings are claims made by the attackers themselves; they are not independent verification that every assertion is accurate or that every named organisation has confirmed the breach. Prior public activity by incransom has involved a range of commercial and institutional targets, typically with the same pattern of data theft followed by pressure via the leak site. In this instance the group claims to have taken internal files from Air Europa and to possess clients’ private information; those statements should be treated as unverified claims until corroborated by the organisation or by independent investigators.

air europa and its sector

Air Europa is a Spanish airline and a full member of the SkyTeam Alliance; it forms part of the Globalia tourism group. Airlines of this scale routinely handle large volumes of passenger data—booking records, contact details, travel documents, payment information, and loyalty-programme data—as well as internal operational files. The sector is a frequent target for ransomware groups because the combination of customer personal data and the operational need to keep flights running creates both financial and reputational pressure. A breach affecting an airline can therefore touch not only the company but also passengers whose journeys, identities, and payment methods may be reflected in the systems involved. Public background on Air Europa’s membership in SkyTeam and its position within Globalia is well established; the specific claim that its systems were compromised rests on the incransom listing.

What data was at risk

The facts state that internal files were exfiltrated in a ransomware attack and that the group claims to hold “a lot of clients private information.” No further breakdown of data types—such as passport numbers, payment-card details, or specific categories of employee records—has been disclosed. Organisations in the airline sector typically store passenger names, contact information, itineraries, identity-document data, and payment-related records, along with internal corporate files. Whether any or all of those categories were among the material taken remains unconfirmed. Readers should therefore treat the exact contents of the exfiltrated files as unknown at present; only the group’s general claim of internal files and clients’ private information is on the public record.

Why it matters

For individuals, the practical risks centre on the possible misuse of personal data: targeted phishing that references real travel history, identity-related fraud, or attempts to exploit payment or loyalty information if such data were included. Because the number of people affected is unknown and the precise data types are unconfirmed, the scale of individual exposure cannot yet be measured. For the organisation, a ransomware incident that includes data exfiltration can disrupt operations, trigger regulatory scrutiny under data-protection rules, and erode passenger trust. The combination of claimed client information and internal files means both customer-facing and corporate consequences are possible, even while many technical and quantitative details remain undisclosed.

What to do if you're exposed

If you have been a customer or employee of Air Europa and are concerned that your information may have been involved, a few measured steps can reduce risk while official details remain limited.

• Monitor bank and card statements for unfamiliar charges and enable transaction alerts where available.
• Treat unexpected emails or messages that reference Air Europa bookings or personal details with caution; verify any request through official channels rather than links in the message.
• Consider placing a fraud alert or credit freeze with the relevant credit-reference agencies if you believe identity data may have been exposed.
• Change passwords for any accounts that reused credentials associated with airline or travel logins, and enable multi-factor authentication where it is offered.
• Run a free exposure scan of your email address to check whether it has already appeared in known breach data sets; this can indicate whether your address has circulated more widely.

Public information about this incident is still incomplete. Continue to rely on official statements from Air Europa or competent authorities for confirmation of scope and for any specific guidance they issue to customers.

AICompiled with AI assistance from public sources and published under our editorial standards.