TAP AIR PORTUGAL - 115k personal data leak Listed by ragnarlocker Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

In September 2022, TAP Air Portugal appeared on a leak site operated by the RagnarLocker ransomware group, which claimed responsibility for a ransomware attack that involved the theft of internal files and described the incident as a 115k personal data leak. Public detail remains limited: the number of people affected is unknown, and independent confirmation of the full scope has not been established beyond the group's listing.

The episode matters because airlines routinely handle large volumes of passenger, employee and operational information. Even when exact contents stay unconfirmed, a claimed exfiltration of internal files raises concrete questions about exposure risk for anyone whose details may have been stored in those systems.

Inside the incident

According to reporting dated 12 September 2022, TAP Air Portugal was listed on the RagnarLocker ransomware leak site. The group stated that it had carried out a ransomware attack and exfiltrated internal files, framing the event as a leak involving 115k personal data records. No further verified particulars—such as the precise date the intrusion began, the initial access method, the duration of access, or forensic confirmation of the volume—have been made public in the available record.

The facts describe the material as internal files taken during a ransomware attack. Whether encryption was also deployed on production systems, whether a ransom demand was issued or paid, and whether the airline publicly acknowledged the listing at the time are not detailed in the disclosed information. The people-affected figure is recorded as unknown. In short, the core public evidence consists of the leak-site listing itself and the group's claim that internal data was stolen.

The group behind it: ragnarlocker

RagnarLocker is a ransomware operation that has been active for several years and is known for double-extortion tactics: encrypting victim systems while also copying data and threatening to publish it if payment is not made. The group typically maintains a dedicated leak site where it names organisations, posts samples or larger archives, and applies pressure through staged releases. Its earlier activity has included attacks on companies across manufacturing, services and other sectors, often with an emphasis on mid-sized to large enterprises whose operations would be disrupted by downtime or data exposure.

In this case, the listing of TAP Air Portugal should be treated as a claim by the group. The available facts do not independently verify the volume of data, the exact nature of every file, or the success of any extortion attempt. RagnarLocker's public pattern is to assert theft and then use the threat of publication; readers should therefore separate the group's statements from confirmed investigative findings.

Who is TAP Air Portugal?

TAP Air Portugal is Portugal's flag-carrier airline, operating scheduled passenger and cargo flights across Europe, Africa, North America and other regions. Like other major carriers, it manages reservations, check-in and boarding processes, loyalty programmes, crew and staff administration, and the supporting IT systems that keep those functions running. Organisations of this type typically hold passenger name records, contact details, travel itineraries, payment-related information, identity or travel-document data where required for border compliance, and internal corporate files covering employees, contractors and business operations.

A breach involving an airline is consequential because the data sets are both personal and operational. Disruption can affect flight operations and customer trust; exposure of personal information can create lasting risks for individuals who flew with or worked for the carrier. The sector's reliance on interconnected booking, airport and partner systems also means that internal files can contain more than a single customer's booking confirmation.

What data was at risk

The facts state that internal files were exfiltrated in a ransomware attack and that the group characterised the incident as a 115k personal data leak. No itemised inventory of fields—such as names, addresses, passport numbers, payment card data or employee records—has been disclosed in the public summary. Exact contents therefore remain unconfirmed.

Airlines and comparable transport organisations commonly store passenger contact and travel data, frequent-flyer information, staff records, and a range of internal operational and commercial documents. It is reasonable to note those categories as the kinds of material that could appear in internal file stores, while being clear that the RagnarLocker listing does not, on the available record, prove which specific elements were taken or published.

The real-world impact

For individuals, the primary risks associated with exposed airline-related data include phishing and social-engineering attempts that reference real flights or bookings, identity fraud if identity or travel-document details were present, and account takeover against loyalty or booking profiles. Even partial internal files can supply enough context for convincing scams. Because the number of people affected is unknown and the precise data types are unconfirmed, the scale of personal harm cannot be quantified from the public facts alone.

For the organisation, a ransomware incident that includes data theft typically brings operational disruption, investigative and recovery costs, regulatory scrutiny under data-protection rules, and reputational damage with passengers and partners. Whether systems were encrypted, how long recovery took, and what notifications were issued are not detailed here; the lasting effect is the residual uncertainty for anyone who may have been included in the claimed internal files.

If your data was in this claimed breach

If you have flown with or worked for TAP Air Portugal and are concerned your information may have been involved, treat unsolicited messages that reference flights, bookings or internal references with caution. Prefer official channels when checking account activity, enable multi-factor authentication on email and travel accounts where available, and monitor financial and credit statements for unfamiliar activity. Consider placing fraud alerts if you believe identity documents or sensitive personal details could have been exposed. You can also run a free exposure scan of your email address to check whether it has already appeared in known breach data sets, which provides one practical indicator of wider exposure without relying solely on any single incident report.

AICompiled with AI assistance from public sources and published under our editorial standards.