Iberia Listed by everest Ransomware Group: Ransomware Claim — What’s Alleged & What To Do
Iberia was listed by the Everest ransomware group on November 25, 2025, after internal files were exfiltrated in a ransomware attack. An undisclosed number of individuals may be affected; anyone with a relationship to the airline should check for any contact from the company and review their accounts for unusual activity.
What happened
The incident came to light through a listing on the everest group's leak site on November 25, 2025. The entry asserts that files were taken from Iberia during a ransomware operation. No information has been released on the date of the intrusion itself, the volume of data involved, or whether any systems were encrypted. The organisation has not issued a public statement confirming or denying the claims.
Inside everest
Everest is a ransomware group that maintains a public leak site where it lists organisations it claims to have targeted. The group typically exfiltrates data before deploying encryption and then uses the site to pressure victims. Its listings function as unverified assertions until corroborated by the affected organisation or independent investigation. In this case, the group claims responsibility for the Iberia incident through the site entry alone.
Who is Iberia?
Iberia, officially Iberia Líneas Aéreas de España, is Spain's flag carrier airline and a subsidiary of International Airlines Group. Founded in 1927 and headquartered in Madrid, it operates an international network from Madrid-Barajas Airport and belongs to the Oneworld airline alliance. As a major airline it maintains extensive records on passengers, employees, flight operations, and commercial partners.
What data was at risk
The listing refers only to internal files exfiltrated in a ransomware attack. No specific categories of data, such as passenger records or employee information, have been identified. Organisations of this type routinely hold booking details, payment information, identity documents, staff records, and operational documents. The exact contents of the claimed exfiltration remain unconfirmed.
What's at stake
Airline data can include personal identifiers and travel histories that, if exposed, may be used for targeted fraud or identity misuse. For the organisation, any confirmed loss of internal files could affect regulatory compliance obligations and require notification to data-protection authorities. The absence of Reported Details means the practical impact on individuals or operations cannot yet be measured.
If your data was in this claimed breach
Monitor official communications from Iberia and any regulatory announcements for further information. Enable multi-factor authentication on frequent-flyer and travel accounts, and review bank and credit statements for unusual activity. Individuals can run a free exposure scan of their email address against known breach data to check for prior appearances in public records.
AICompiled with AI assistance from public sources and published under our editorial standards.
How this breach connects
More recent breaches
Iberia Airlines Listed by everest Ransomware GroupAir Miles España, S.A Listed by everest Ransomware GroupDublin Airport Listed by everest Ransomware GroupAir Arabia Listed by everest Ransomware GroupLatest breaches
Read GalaxyWarden’s full analysis of the Iberia Listed by everest Ransomware Group →
Publicly posted by everest — unverified claim, pending independent verification
Breach listings — particularly those originating from ransomware or leak sites — are third-party claims that may be unverified, incomplete, or inaccurate. A listing does not by itself confirm that a breach occurred or that any specific data was exposed. Severity is an automated assessment, not a definitive rating. Verification status is shown where available.
Attributions to threat groups and methods reflect public reporting and, in some cases, unverified claims made by the groups themselves; they may be incomplete or later revised. Recent Breaches and GalaxyWarden are independent and are not affiliated with, and do not endorse, any company or group named on this page. This information is aggregated from public sources for awareness only and is not legal, security, or investment advice.