Bourse des Vols Data Breach (2021): What Was Exposed & What To Do

In January 2021, the French travel company Bourse des Vols experienced a data breach that exposed information associated with approximately 1.5 million individuals. The incident involved more than 1.2k SQL files totaling over 9GB, containing personal details and travel records. This event is one of many reported that year involving companies that store customer identities alongside travel histories. Such incidents illustrate how data held by service providers can become accessible beyond its intended scope once security controls are bypassed.

Inside the incident

The breach was reported on January 12, 2021. It affected 1.46 million unique email addresses belonging to customers of Bourse des Vols. The exposed material was distributed across more than 1.2k .sql files and exceeded 9GB in volume. Named data types included names, phone numbers, physical addresses, dates of birth, IP addresses, flights taken, and purchases. No further details on the method of access, exact timeline of the intrusion, or attribution have been disclosed in available reporting.

How a breach like this happens

Incidents involving large volumes of structured data files often begin with an attacker obtaining credentials or exploiting a misconfigured database server. Once inside, the actor can query and export tables that contain customer records. Travel-related platforms frequently maintain combined datasets of identity information and transaction histories, which increases the quantity of records that can be retrieved in a single operation. The presence of multiple .sql files suggests systematic extraction rather than incidental exposure.

Who is Bourse des Vols?

Bourse des Vols operates as a French travel company that facilitates flight bookings and related services. Organizations in this sector routinely collect and retain customer names, contact details, payment information, and records of travel itineraries to process reservations and provide support. A breach at such a firm is consequential because the data set combines stable identifiers such as dates of birth with time-specific details like flights taken, creating a durable profile of an individual’s movements and preferences.

What was likely exposed

The reported breach named specific categories of information. Public detail on additional fields remains limited.

• Dates of birth
• Email addresses
• Flights taken
• IP addresses
• Names
• Phone numbers
• Physical addresses
• Purchases

What's at stake

For individuals, the exposure of names, addresses, dates of birth, and travel histories can support targeted phishing or identity-verification attempts that reference past trips. Contact details increase the volume of unsolicited messages. For the organization, the incident creates obligations around notification, remediation of the access point, and potential regulatory scrutiny under data-protection rules applicable to French companies. The persistence of the data in later breach compilations extends these effects beyond the initial disclosure date.

If your data was in this breach

Begin by changing passwords on any accounts that reuse credentials associated with the exposed email address. Enable multi-factor authentication where available. Monitor statements and travel loyalty accounts for unrecognized activity. Readers can run a free exposure scan of their email address against known breach data to determine whether their information appears in this or other incidents.

AICompiled with AI assistance from public sources and published under our editorial standards.