TAP Air Leak of more than 1.5 million of customers and many other. Listed by ragnarlocker Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On 19 September 2022, the Portuguese airline TAP Air appeared on the leak site operated by the ransomware group ragnarlocker. The listing claimed a leak involving more than 1.5 million customers and other material, and stated that internal files had been taken in a ransomware attack. Public detail remains limited: the number of people actually affected is unknown, and independent confirmation of the volume or contents has not been published.

For customers, employees and partners, the listing raises practical questions about what may have left the organisation’s systems and what residual risk that creates. The account below sticks to what has been reported and to established public knowledge of the actor and the sector.

What happened

According to the available record, TAP Air was listed on the ragnarlocker ransomware leak site on 19 September 2022. The group’s entry described a “TAP Air Leak of more than 1.5 million of customers and many other” and asserted that internal files had been exfiltrated in a ransomware attack. The group claims to have stolen internal data. No further technical detail—such as the initial access method, the duration of any intrusion, or forensic confirmation of the claimed volume—has been disclosed in the material provided. The number of people affected is recorded as unknown. Whether any ransom demand was made or paid, and whether data were later published in full, is not stated in the public summary.

The group behind it: ragnarlocker

RagnarLocker is a ransomware operation that has been active for several years and is documented in public reporting as using double-extortion tactics: encrypting systems while also copying data and threatening to release it if payment is not made. The group has typically targeted mid-sized and larger organisations across multiple sectors, often after gaining access through compromised credentials, exposed remote services or other common entry points. Once inside, operators have been observed moving laterally, staging data for exfiltration, and deploying ransomware. Listings on their leak site function as pressure on the victim and as a public claim of success; such listings are claims by the group unless independently verified. Nothing in the present record goes beyond the group’s assertion that it took internal TAP Air data and that the incident involved more than 1.5 million customers and other material.

Who is TAP Air?

TAP Air (Transportes Aéreos Portugueses) is Portugal’s flag-carrier airline, operating passenger and cargo services across Europe, Africa, North America and other routes. Like other commercial airlines, it maintains large volumes of operational, commercial and customer-related information: booking and passenger name records, loyalty-programme data, employee and contractor records, supplier contracts, flight-operations material and internal corporate files. A breach affecting such an organisation is consequential because the data can touch travellers, staff and business partners in multiple jurisdictions, and because airlines are critical infrastructure whose disruption or data loss can affect safety, operations and trust.

The information in question

The facts name the exposed material only as “internal files exfiltrated in a ransomware attack.” The group’s listing further claims involvement of more than 1.5 million customers and “many other” items. Exact data types—whether passenger records, payment details, identity documents, employee files, or purely operational documents—are not disclosed in the public summary. Organisations of this kind typically hold booking data, contact details, travel itineraries, frequent-flyer information, and internal business documents; however, which of those categories, if any, were actually taken remains unconfirmed. Readers should treat specific content claims as unverified until corroborated by the airline or by independent investigation.

What's at stake

For individuals, the main risks are misuse of personal or travel-related information if it was among the taken files: targeted phishing that references real bookings, identity fraud, or unwanted contact. Even partial internal documents can help attackers craft convincing social-engineering messages. For the airline, stakes include regulatory scrutiny under data-protection rules, potential notification duties, operational and reputational cost, and the possibility that remaining access or secondary copies of data could be used later. Because the scale and precise contents are unconfirmed, the practical impact on any single person cannot be stated with certainty from the public record alone.

If your data was in this claimed breach

If you have flown with or otherwise dealt with TAP Air and are concerned your information may have been involved, consider the following measured steps:

• Treat unsolicited messages that reference flights, bookings or account details with caution; verify through official channels rather than links or attachments in the message.
• Monitor bank and card statements for unfamiliar charges if you have ever stored payment methods with the airline.
• Change passwords on related accounts and enable multi-factor authentication where available.
• Review loyalty or frequent-flyer account activity for unexpected changes.
• Keep records of any suspicious contact in case you later need to report fraud.

You can also run a free exposure scan of your email address to check whether it has already appeared in known breach data sets. Public detail on this incident is limited; official statements from the organisation, if issued, remain the primary source for confirmation of scope and next steps.

AICompiled with AI assistance from public sources and published under our editorial standards.