Iberia Airlines Listed by everest Ransomware Group: Ransomware Claim — What’s Alleged & What To Do
Iberia Airlines was listed by the everest ransomware group on November 25, 2025, after internal files were exfiltrated in a ransomware attack. An undisclosed number of individuals may have been affected; anyone who has flown with Iberia or shared data with the airline should review their accounts and monitor for suspicious activity.
Breaking down the breach
The only confirmed information is the listing itself and the statement that internal files were taken during a ransomware attack. No figure for the volume of data, the date of the intrusion, or the encryption status of systems has been released. Iberia has not issued a public statement confirming or denying the claims at the time of reporting.
Who is everest?
Everest is a ransomware group that publishes victim names on a leak site when negotiations fail or to increase pressure. The group typically claims to have stolen data before encrypting systems and demands payment to prevent publication. Its listings are assertions made by the group; independent confirmation of any specific incident requires statements from the affected organisation or law-enforcement findings.
Iberia Airlines and its sector
Iberia Líneas Aéreas de España is Spain’s flag carrier, founded in 1927 and headquartered in Madrid. It operates an international network and forms part of the International Airlines Group alongside British Airways and Aer Lingus. Airlines in this sector maintain extensive records on passengers, bookings, loyalty programmes, crew and maintenance operations.
What data was at risk
The listing refers only to “internal files.” The exact categories of information contained in those files have not been disclosed. Organisations of this type commonly hold names, contact details, passport information, payment records and travel histories, yet it is not confirmed whether any of these data types were among the material taken.
What's at stake
For individuals, the main concern is the potential misuse of personal or financial details if they appear in the exfiltrated material. For the airline, the incident adds to operational and regulatory pressures already faced by carriers that handle cross-border travel data. Both outcomes depend on the still-unverified contents of the files.
What to do if you're exposed
Monitor bank and loyalty accounts for unusual activity and consider placing fraud alerts with credit agencies. Use strong, unique passwords and enable multi-factor authentication on any accounts linked to travel bookings. Readers can run a free exposure scan of their email address to check whether their information has appeared in previously published breach data sets.
AICompiled with AI assistance from public sources and published under our editorial standards.
How this breach connects
More recent breaches
Iberia Listed by everest Ransomware GroupAir Miles España, S.A Listed by everest Ransomware GroupDublin Airport Listed by everest Ransomware GroupAir Arabia Listed by everest Ransomware GroupLatest breaches
Read GalaxyWarden’s full analysis of the Iberia Airlines Listed by everest Ransomware Group →
Publicly posted by everest — unverified claim, pending independent verification
Breach listings — particularly those originating from ransomware or leak sites — are third-party claims that may be unverified, incomplete, or inaccurate. A listing does not by itself confirm that a breach occurred or that any specific data was exposed. Severity is an automated assessment, not a definitive rating. Verification status is shown where available.
Attributions to threat groups and methods reflect public reporting and, in some cases, unverified claims made by the groups themselves; they may be incomplete or later revised. Recent Breaches and GalaxyWarden are independent and are not affiliated with, and do not endorse, any company or group named on this page. This information is aggregated from public sources for awareness only and is not legal, security, or investment advice.