Lawyers Probe Frontier Airlines Data Breach

Lawyers are already hunting for potential victims of a data breach at Frontier Airlines after the Denver-based ultra-low-cost carrier disclosed a potential cybersecurity incident to the Vermont Attorney General late last week. The disclosure is thin on detail — and that vacuum is exactly what the plaintiffs' bar has moved into.

So far, Frontier has not provided specifics about the nature of the breach, including how many customers may have been affected or what categories of data were compromised. The airline did not immediately respond to a request for comment.

The absence of information has not slowed down the class-action firm Edelson Lechtzin LLP, which has opened its own investigation into the incident with a view to potentially suing Frontier for failing to keep customer data secure. That is the standard playbook after a regulatory disclosure: the filing itself becomes the trigger, long before the company has finished working out what actually happened.

An industry that has become a target

Frontier joins a long and uncomfortable list. A run of international airlines has been hit by cybersecurity incidents over the past couple of years, the majority of them linked to a third-party customer-service IT platform used by numerous high-profile companies.

Air France and KLM Royal Dutch Airlines told customers last August that anyone who had recently contacted their customer-service departments could have had personal data compromised — full name, contact details, frequent-flyer status and the subject lines of service-request emails. Qantas was caught up in the same breach of software supplied by Salesforce. In those cases the attackers are not believed to have reached credit-card information or passport numbers, though privacy specialists have warned that even the data that was taken can fuel sophisticated identity-theft scams. Hawaiian Airlines and WestJet have also been counted among recent victims.

The wave has arrived at a moment when the entire industry was already on alert to threats from international hacking groups, including the notorious Scattered Spider. Rather than breaking systems with code, Scattered Spider tends to use social engineering — talking its way past IT helpdesks by posing as a locked-out employee to get access to sensitive systems. It is a reminder that the weakest point in an airline's security perimeter is often a human being on a phone call, not a firewall.

When cyber incidents reach the tarmac

None of the airline data breaches listed above had an operational impact. But cyber attacks on aviation infrastructure certainly can. Last September a major attack took down check-in systems at several European airports, including London Heathrow, Berlin Brandenburg and Brussels Airport. The affected system was the Collins Rockwell Muse platform, owned by US aerospace company Collins Aerospace, and engineers needed days to restore it — producing hundreds of cancellations and delays in the meantime.

In 2024, Seattle-Tacoma International Airport suffered a ransomware attack that knocked out check-in, baggage handling and information-display screens across its terminals for days. The Port of Seattle later attributed the attack to the hacker group Rhysida, which had threatened to publish stolen airport data on the dark web unless a ransom was paid. Officials refused to pay and pledged to strengthen their IT security.

For Frontier, the immediate exposure is legal and reputational rather than operational. What the carrier has said publicly is that a potential cybersecurity incident occurred; what it has not said is how big it was. Until it does, the airline is likely to find that lawyers, not customers, are the ones asking the questions.

Sources: Paddle Your Own Kanoo. Featured image: AI-generated by AviationShop. By Elena Vargas.