TAP Air Portugal data breach: what happened and what to do

What happened

In August 2022, the Portuguese airline TAP Air Portugal was the target of a ransomware attack. Have I Been Pwned (HIBP) says the Ragnar Locker gang later leaked the stolen data on a public dark web site. HIBP counts 6,083,479 accounts, with over 5 million unique email addresses.

BleepingComputer covered the attack when it surfaced in late August 2022. TAP said at the time that it had blocked the attack and found no evidence that customer data had been reached. Ragnar Locker disagreed. It said hundreds of gigabytes of data might have been taken and posted a screenshot of a spreadsheet that appeared to show customer details. The data was later released publicly, which is what HIBP loaded.

What was exposed

HIBP lists dates of birth, email addresses, genders, names, nationalities, phone numbers, physical addresses, salutations and spoken languages. HIBP lists no passwords and no payment card numbers.

What that lets criminals do

Name, date of birth, phone number and home address together are the raw material for identity fraud and for believable phishing. A message that knows you flew with TAP, and uses your name and language, is easier to believe. Phone numbers also open the door to text message scams (smishing) and, less often, SIM swap attempts where a scammer tries to talk your mobile carrier into moving your number.

What to do now

You can't change your date of birth. Spot misuse early instead. Be wary of emails or texts about TAP bookings, refunds or vouchers. Don't click links in them: go to the airline's website directly. If you're in the US, you can place a free credit freeze at the three credit bureaus.