Iberia Notifies Customers of Data Security Incident Involving Loyalty Club Accounts

Iberia Airlines has begun contacting customers after detecting a security incident involving one of its external service providers. The breach, which Iberia says was caused by unauthorised access to the provider’s systems, has resulted in the exposure of certain personal data belonging to some Iberia clients, including those linked to the Iberia Club loyalty programme.

What Data Was Affected?

According to the email Iberia is sending to affected customers, the following information may have been compromised:Name and surname

Email address

Iberia Club loyalty card identification number

Iberia stresses that no account passwords, login credentials, or full bank-card details were accessed. The airline confirms that payment information remains secure and cannot be used.

How Iberia Has Responded

Iberia reports that it activated its security protocols immediately after detecting the incident. Measures taken include:

Containing the breach and working with the service provider to secure the affected system

Introducing two-factor authentication for any change to the email address linked to an Iberia account

Continuous monitoring of its systems for suspicious activity

Notifying the relevant data-protection authorities in accordance with GDPR requirements

Continuing an internal and external investigation

At this stage, Iberia states that it has no evidence of fraudulent use of the exposed data.

Advice for Customers

Although Iberia has not detected misuse of the information, they recommend that customers remain vigilant and take the following precautions:

Be cautious with unexpected emails, messages, or calls claiming to be from Iberia

Avoid clicking on links or providing personal details unless you are certain the communication is genuine

Report any suspicious activity to Iberia’s call centre at +34 91 333 6701

For data-protection enquiries, Iberia’s Data Protection Officer can be contacted at Customer_privacy@iberia.es

Customers will receive further updates if Iberia uncovers additional information as its investigation progresses.

Data breaches involving third-party suppliers have become increasingly common across many sectors, and while Iberia states that no passwords or financial information have been compromised, the exposure of names and email addresses can lead to phishing attempts or unsolicited contact. Customers are therefore encouraged to take the airline’s advice seriously and remain alert.

Citizens Advice Spain will continue to monitor developments and will provide updates should more information become available.