6 August 2025
Air France / KLM
Company Aviation
Air France and KLM disclosed in early August 2025 that an external platform used for customer service had been accessed without authorisation. They stressed that the compromised environment was a third-party customer-service platform, not their core airline networks. The number of customers was never publicly disclosed.
Dated facts in the public record
Air France and KLM begin public notification of unauthorised access to an external customer-service platform.
Security press reports the breach and confirms the companies will not disclose the victim count while the investigation is active.
How it happened
The airlines confirmed that the unauthorised activity occurred on an external platform used by their contact centres and said their own networks were not affected. They did not publicly name the vendor. Security reporting connected the incident to a broader campaign against third-party CRM services; BleepingComputer asked whether Salesforce was involved and the company declined to confirm. The vendor and any social-engineering path remain unconfirmed by Air France-KLM.
What was exposed
Names, contact information, Flying Blue membership number and status, and the subject of requests made to customer service. Some notices also referred to notes connected with those interactions. That combination can let a fraudster construct highly plausible messages that refer to a real loyalty account and a genuine prior support issue.
What was not in scope
The airlines said passwords, passport numbers, payment-card information, travel itineraries and Flying Blue mileage balances were not affected. Core Air France and KLM networks were also described as unaffected.
What it meant in practice
The direct operational impact appears limited compared with incidents that took production systems offline. The primary risk is fraud: an attacker can use real support history and loyalty information to impersonate an airline, claim a booking or account issue, or attempt credential theft through a fake support flow.
What was done next
The companies and the external provider cut off the unauthorised access, took measures intended to prevent recurrence, notified data-protection authorities — Air France the CNIL, KLM the Dutch authority — and contacted affected customers. Customers were warned about suspicious email and telephone contact.
What later reporting changed
The original account remains broadly accurate. The victim count is unknown, and a possible Salesforce connection is not company-confirmed.
In their words
unusual activity on an external platform we use for customer service
Air France-KLM statement, in English
direct action to stop the unauthorized access
KLM customer communication, English rendering
What does this mean?
- Phishing
- A message or call that imitates a real organisation to get you to hand over a password, a code or a payment.
- Credentials
- A username and password pair, or the equivalent key an application uses to log in.