{"meta":{"project":"France Cyberwatch 2025-2026","reviewedThrough":"2026-08-16","schemaVersion":"1.3.0","scope":{"en":"Curated public-interest dataset of major publicly reported cyberattacks and data breaches affecting French public institutions and companies in 2025 and 2026. It is not a complete register. Unknown or disputed victim counts are not converted into confirmed statistics.","fr":"Jeu de données d’intérêt public sur les principales cyberattaques et fuites de données rendues publiques touchant des institutions publiques et des entreprises françaises en 2025 et 2026. Il ne constitue pas un registre exhaustif. Les nombres de victimes inconnus ou contestés ne sont pas convertis en statistiques confirmées."},"methodology":{"en":"Prefer official disclosures. Keep unknown values as null. Keep disputed attacker claims in labels or notes rather than numeric fields used for charts. Do not attribute attackers unless public evidence supports the attribution.","fr":"Privilégier les communiqués officiels. Conserver les valeurs inconnues à null. Garder les revendications contestées dans les libellés ou notes plutôt que dans les champs numériques utilisés pour les graphiques. Ne pas attribuer une attaque sans éléments publics suffisants."},"rules":{"affectedCounts":{"en":"Plot only incidents where affected is a non-null numeric value.","fr":"Ne représenter que les incidents dont le champ affected est une valeur numérique non nulle."},"unknownCounts":{"en":"Display as Unknown / under investigation, never as zero.","fr":"Afficher comme Inconnu / sous enquête, jamais comme zéro."},"disputedClaims":{"en":"Do not include disputed attacker-claimed victim counts in aggregate charts.","fr":"Ne pas inclure les nombres de victimes revendiqués et contestés dans les graphiques agrégés."}},"lang":"en"},"incident":{"id":"airfrance","date":"2025-08-06","year":2025,"org":"Air France / KLM","domain":"airfrance.com","kind":"company","sector":"Aviation","sectorLabel":"Aviation","severity":"high","status":"confirmed","affected":null,"affectedLabel":"Number not publicly disclosed","data":"Names, contact details, Flying Blue number and status, and subjects of customer-service requests. Passwords, travel data, passport and card numbers were reported unaffected.","method":"Unauthorised access to a third-party customer-service platform; the vendor is unnamed.","risk":"Highly believable phishing and impersonation using real loyalty and support context.","confidence":"Confirmed by the airlines; customer count unpublished; any Salesforce link is unconfirmed.","sourceName":"KLM","sourceId":"airfranceKlm","sourceUrl":"https://nieuws.klm.com/klm-informeert-klanten-over-incident-met-persoonsgegevens/","sourceIds":["airfranceKlm","airfrance","airfranceBleeping","airfranceSecurityweek"],"lastResearched":"2026-08-16","url":"/incident/airfrance","detail":{"lead":"Air France and KLM disclosed in early August 2025 that an external platform used for customer service had been accessed without authorisation. They stressed that the compromised environment was a third-party customer-service platform, not their core airline networks. The number of customers was never publicly disclosed.","timeline":[{"date":"2025-08-06","label":"Air France and KLM begin public notification of unauthorised access to an external customer-service platform."},{"date":"2025-08-07","label":"Security press reports the breach and confirms the companies will not disclose the victim count while the investigation is active."}],"how":"The airlines confirmed that the unauthorised activity occurred on an external platform used by their contact centres and said their own networks were not affected. They did not publicly name the vendor. Security reporting connected the incident to a broader campaign against third-party CRM services; BleepingComputer asked whether Salesforce was involved and the company declined to confirm. The vendor and any social-engineering path remain unconfirmed by Air France-KLM.","taken":"Names, contact information, Flying Blue membership number and status, and the subject of requests made to customer service. Some notices also referred to notes connected with those interactions. That combination can let a fraudster construct highly plausible messages that refer to a real loyalty account and a genuine prior support issue.","notTaken":"The airlines said passwords, passport numbers, payment-card information, travel itineraries and Flying Blue mileage balances were not affected. Core Air France and KLM networks were also described as unaffected.","impact":"The direct operational impact appears limited compared with incidents that took production systems offline. The primary risk is fraud: an attacker can use real support history and loyalty information to impersonate an airline, claim a booking or account issue, or attempt credential theft through a fake support flow.","response":"The companies and the external provider cut off the unauthorised access, took measures intended to prevent recurrence, notified data-protection authorities — Air France the CNIL, KLM the Dutch authority — and contacted affected customers. Customers were warned about suspicious email and telephone contact.","methodDisclosure":"partial","revision":"The original account remains broadly accurate. The victim count is unknown, and a possible Salesforce connection is not company-confirmed.","quotes":[{"text":"unusual activity on an external platform we use for customer service","original":"unusual activity on an external platform we use for customer service","originalLang":"en","attribution":"Air France-KLM statement, in English","sourceId":"airfranceBleeping"},{"text":"direct action to stop the unauthorized access","original":"direct action to stop the unauthorized access","originalLang":"en","attribution":"KLM customer communication, English rendering","sourceId":"airfranceKlm"}]}},"source":{"id":"airfranceKlm","name":"KLM — customer notice on a personal-data incident","url":"https://nieuws.klm.com/klm-informeert-klanten-over-incident-met-persoonsgegevens/","publisher":"KLM","kind":"primary","published":"2025-08-06"},"sources":[{"id":"airfranceKlm","name":"KLM — customer notice on a personal-data incident","url":"https://nieuws.klm.com/klm-informeert-klanten-over-incident-met-persoonsgegevens/","publisher":"KLM","kind":"primary","published":"2025-08-06"},{"id":"airfrance","name":"ITPro — Air France and KLM third-party breach","url":"https://www.itpro.com/security/data-breaches/air-france-and-klm-confirm-customer-data-stolen-in-third-party-breach","publisher":"ITPro","kind":"secondary","published":"2025-08-06"},{"id":"airfranceBleeping","name":"BleepingComputer — Air France and KLM third-party breach","url":"https://www.bleepingcomputer.com/news/security/air-france-and-klm-disclose-data-breaches-impacting-customers/","publisher":"BleepingComputer","kind":"secondary","published":"2025-08-07"},{"id":"airfranceSecurityweek","name":"SecurityWeek — Air France, KLM customer data accessed","url":"https://www.securityweek.com/air-france-klm-say-hackers-accessed-customer-data/","publisher":"SecurityWeek","kind":"secondary","published":"2025-08-07"}]}