Iberia tells customers it was hit by a major security breach

• Iberia disclosed a third‑party breach exposing customer names, emails, and loyalty card IDs, but not passwords or banking data
• A dark web ad claims 77 GB of Iberia’s internal technical files were stolen, raising questions of a separate attack
• Investigation is ongoing, law enforcement notified, and customers urged to stay alert for suspicious communications

Spain’s national airline Iberia is notifying customers of a third-party cyberattack and data theft incident.

In a data breach notification letter shared on social media, Iberia said a malicious threat actor gained access to a third-party supplier, through which it managed to steal full names, email addresses, and the Iberia Club loyalty card identification numbers of an undisclosed number of customers.