Viva Air Data Breach (2022): What Was Exposed & What To Do

In March 2022, Viva Air, a Colombian airline that has since ceased operations, experienced a data breach that exposed records tied to 932,000 unique email addresses. The incident involved a ransomware attack and included a log of 2.6 million transactions containing names, physical addresses, phone numbers, IP addresses, and partial credit card data. The breach was reported on 14 March 2022. Public records indicate the data formed part of a larger collection of ransomed material.

What happened

In March 2022, Viva Air suffered a data breach and subsequent ransomware attack. The incident resulted in the exposure of a transaction log containing 2.6 million entries linked to 932,000 unique email addresses. The reported data types include names, physical addresses, phone numbers, IP addresses, purchases, and partial credit card data showing only the last four digits.

Details on the precise intrusion method, the timeline of access, and any ransom demands or payments remain undisclosed in available reporting. The airline is now defunct.

Who is ransomexx?

RansomEXX is a ransomware group known for targeting mid-sized and large organizations across multiple sectors. The group typically employs double-extortion tactics, encrypting systems while also exfiltrating data for potential publication on a leak site if demands are not met.

Public reporting has linked the group to prior incidents involving healthcare providers, government agencies, and private companies. In this case, the attribution to RansomEXX rests on the group’s listing of Viva Air; that listing constitutes a claim by the group rather than an independently verified confirmation of every detail.

About Viva Air

Viva Air operated as a low-cost airline based in Colombia, serving domestic and international routes. Airlines routinely collect and store customer information to process bookings, manage loyalty programs, handle payments, and comply with regulatory requirements for passenger identification and security.

Such organizations maintain records that can span years of travel history. A breach at an airline therefore carries implications for large volumes of personal and transactional data accumulated through routine operations.

What was likely exposed

The reported incident exposed email addresses, names, physical addresses, phone numbers, IP addresses, purchase details, and partial credit card data limited to the last four digits. These elements were contained in a log of 2.6 million transactions affecting 932,000 unique email addresses.

Exact file contents, additional data fields, or the full scope of any other systems accessed have not been disclosed. Organizations in the airline sector commonly hold further categories of information such as passport details, frequent-flyer records, and full payment card numbers processed through secure channels; whether those were present in the exposed material remains unconfirmed.

Why it matters

Exposure of names, addresses, phone numbers, and email addresses can facilitate targeted phishing or social-engineering attempts. Partial credit card data, while incomplete, can still be combined with other information to increase the success rate of fraudulent transactions or account takeovers.

For the organization, the incident adds to operational and reputational consequences at a time when Viva Air was already moving toward closure. Affected individuals face the standard risks associated with the reuse of email addresses and contact details across multiple services.

If your data was in this breach

Review bank and credit card statements for any unauthorized activity and consider requesting new card numbers if the last four digits match records you hold. Use unique passwords for different accounts and enable multi-factor authentication where available. Monitor email inboxes for unsolicited messages that reference the exposed details.

Individuals can run a free exposure scan of their email address against known breach data sets to determine whether their information appears in this or other publicly documented incidents.

AICompiled with AI assistance from public sources and published under our editorial standards.