Iberia Airlines Listed by everest Ransomware Group

On November 25, 2025, Iberia Airlines appeared on the leak site of the Everest ransomware group after the attackers claimed to have exfiltrated internal files during a ransomware incident. The Spanish national carrier, which serves millions of passengers annually, has not yet disclosed the exact number of people whose information may be contained in the stolen data.

What's Publicly Reported from Reporting

Public reporting indicates that Everest posted details about the Iberia breach on its dark-web leak site. The airline has not released an official statement confirming the volume or type of data taken. Available reporting describes the incident as involving internal files exfiltrated rather than a direct compromise of customer booking systems. No confirmed list of exposed record types, such as passport numbers or payment details, has been made public at the time of writing.

Why This Matters for You and Your Family

When an airline the size of Iberia suffers a breach, the stolen files can contain names, addresses, contact details, frequent-flyer numbers, and travel histories of ordinary customers and their families. If your email, phone number, or passport information is among the records, criminals can use it to attempt account takeovers on travel platforms, loyalty programs, or linked financial services. For families this often means children’s names and dates of birth appearing alongside parental contact data, creating long-term risks of identity fraud that can affect college applications, credit scores, or future employment years later.

Travel records and loyalty accounts are especially valuable because they link real identities to frequent destinations, phone numbers, and email addresses that appear across dozens of other services.

The Doxxing and Identity-Chain Risks

Stolen travel data rarely stays isolated. Attackers combine airline records with information from earlier breaches to build detailed identity chains. A single leaked frequent-flyer number can be matched to a gaming username, a child’s Roblox or Fortnite account, or a family member’s social-media handle. Once these connections are mapped, targeted doxxing, SIM-swapping, or extortion attempts become far easier. Credential leaks like this one routinely cascade into account takeovers on gaming platforms because the same email and password combinations are reused across travel, email, and entertainment services.

Everest Ransomware Group Track Record

Public reporting attributes the attack to the Everest ransomware group, which first emerged in 2020. The group has listed hundreds of organizations on its leak site, including healthcare providers, manufacturers, and transportation companies. Its typical playbook involves gaining initial access through phishing or exploited remote-desktop services, exfiltrating data before deploying ransomware, then publishing samples on its leak site if the victim refuses to pay. Everest usually sets short payment deadlines measured in days and gradually releases more data to increase pressure.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, travel accounts, and real-world identity so you can see exactly what chains exist today.
• Rotate any password you used on Iberia’s website or app anywhere else it is reused, and switch to a hardware key or authenticator app for 2FA instead of SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next leak that touches your family is caught and acted on within hours rather than months.
• Cover the household with DoxxScan family protection that extends to children’s gaming accounts, which often become the next target once credential leaks like this one surface.
• Let remediation specialists handle the follow-up work of sending takedown notices to data brokers and monitoring for resale of any exposed travel or personal records.

The incident shows that even large, well-known organizations continue to lose control of customer data. Taking concrete steps now limits how far any single breach can reach. DoxxScan by GalaxyWarden provides continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping that connects online handles to real identities, and hands-on remediation by specialists who manage takedowns for you and your entire household, including children’s gaming accounts that frequently become targets after credential leaks like Iberia’s.