Iberia Airlines Breach

Overview

In late November 2025, the Everest ransomware group claimed responsibility for a data breach targeting Iberia Airlines, originating from a vulnerability in the Collins Aerospace vMUSE passenger processing system.

On December 9, 2025, following the expiration of their ransom deadline, Everest announced the full publication of the stolen data. The group stated: "Because the company failed to respond by the deadline, we posted all the data."

Leak Details & Dissemination

The threat actors have employed aggressive tactics to ensure the data remains permanently accessible:

• Full Publication: Everest released download links for the complete dataset via file-hosting service Gofile. This includes a specific distribution of "only csv files" (likely containing the structured passenger manifests and loyalty databases).
• Widespread Mirroring: To counter legal takedown efforts, the group explicitly stated that "all the data was duplicated across various hacker forums and leak database sites." They noted that they have re-uploaded files in obscure locations ("places the legal department is unlikely to find") to make total deletion impossible.
• File Evidence: Screenshots provided by the group show a specific archive named Iberia Air.rar with a file size of 324.6 GB, confirming a massive exfiltration of data.

Compromised Data (Updated)

With the release of the "CSV only" files, the exposure of structured database information is confirmed.

• Customer PII: Full names, emails, and phone numbers (confirmed).

Claimed -

• Flight Manifests: Passenger lists, seating assignments, and travel dates (linked to vMUSE architecture).
• Loyalty Data: Iberia Plus numbers and associated tier status.
• Internal Data: Technical documents and Collins Aerospace system logs.