Overview

• KLM detected unauthorized access to a third-party customer service platform in early August
• Exposed details were limited to names, contact information, Flying Blue membership numbers and tier levels, email subject lines and customer service remarks
• No sensitive credentials such as credit card numbers, passport details, passwords, booking information or frequent-flyer balances were involved
• The airline and its vendor contained the incident, reinforced security controls and reported it to the Dutch Data Protection Authority under GDPR
• Customers are advised to scrutinize unexpected calls or messages to guard against phishing attempts that may exploit the leaked information