TAP Air Portugal Data Breach (2022)

On August 25, 2022, Portuguese national carrier TAP Air Portugal appeared in a ransomware leak-site listing after the Ragnar Locker gang claimed responsibility for an intrusion that ultimately exposed data belonging to 6.1 million individuals.

Primary Disclosure Details

The listing on the Ragnar Locker leak site, later indexed by Have I Been Pwned, states that the airline suffered a ransomware attack in which attackers exfiltrated customer records. The exposed information includes names, dates of birth, genders, nationalities, spoken languages, salutations, email addresses, phone numbers and physical addresses. The disclosure does not specify the exact number of records taken beyond the 6.1 million figure later confirmed, nor does it detail the precise method of initial access or the ransom demand amount. What is certain is that over 5 million unique email addresses were published alongside the other personal identifiers.

Why This Matters for You and Your Family

If you have ever flown with TAP Air Portugal, booked tickets for relatives, or used your email address for any reservation, your personal details may now sit in multiple criminal databases. A single breach of this scale turns routine travel data into long-term ammunition for identity thieves, phishing campaigns, and social-engineering attacks. Because the records combine contact information with demographic details such as date of birth and physical address, attackers can build convincing profiles that make fraudulent account openings, loan applications, or targeted scams far more credible. Families are especially exposed when one parent’s booking contains children’s dates of birth and passport-related data that later surfaces in the same dataset.

Doxxing and Identity-Chain Risks

Once names, addresses, phone numbers and email addresses are public, attackers rarely stop at the initial leak. They cross-reference the data with gaming accounts, social-media handles and loyalty-program profiles to construct full identity chains. A child’s Minecraft or Roblox username linked to a parent’s breached TAP email can quickly lead to account takeovers, in-game extortion or doxxing that reveals home addresses to harassers. Credential-stuffing attacks become trivial when the same password used for a TAP booking is reused on banking or email services. The 2022 leak therefore represents not a one-time exposure but the starting point of cascading compromise that can affect every member of a household for years.

Ragnar Locker’s Known Track Record

Public reporting attributes the first major Ragnar Locker campaigns to late 2019. The group has since hit manufacturing, logistics and travel-sector targets, including several European airlines and airport-service providers. Their typical playbook begins with compromised remote-desktop credentials or phishing, followed by domain-wide encryption and exfiltration of customer databases. After encryption they demand payment and, if unmet, publish samples and eventually full datasets on their leak site. The TAP Air Portugal incident followed this pattern exactly: access, theft, extortion, then public release of the 6.1 million records when negotiations failed.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers and real identity, then use the cleanup to remove what you can.
• Rotate the password used at TAP Air Portugal anywhere it is reused and enable 2FA through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure is caught in hours, not months.
• Cover the household with DoxxScan family coverage that extends to dependents and children’s gaming accounts that often chain back to the same address and breached emails.
• Let remediation specialists handle ongoing takedown requests across data brokers and leak sites on your behalf.

The TAP breach is a reminder that travel loyalty and booking data are high-value targets that continue to surface long after the initial incident. Starting now with systematic monitoring and cleanup gives you and your family the best chance of staying ahead of the identity thieves who have already received this information. DoxxScan by GalaxyWarden delivers that continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that explicitly includes children’s gaming accounts vulnerable to credential leaks like this one.