Air France Data Breach Lawsuit Alleges Airline Ignored Cybersecurity Risks

Case Overview: The lawsuit claims Air France failed to prevent a cyberattack that exposed passenger data and did not alert victims promptly.

Consumers Affected: Passengers whose personal or financial data was compromised in the Air France breach.

Court: U.S. District Court for the Eastern District of New York

Air France is facing a new lawsuit from U.S. passengers who claim the airline failed to safeguard personal data stored on its computer systems. 

The filing alleges that a cyberattack exposed sensitive information belonging to thousands of customers and that the company did not act quickly enough to warn victims once the breach occurred.

Plaintiffs Ethan Allison and Arya Soofiani filed the case on behalf of affected individuals nationwide, claiming Air France did not maintain adequate digital security protocols to prevent unauthorized access. 

The complaint says the airline’s alleged negligence made its systems an “easy target” for cybercriminals seeking to steal customer data.

Hackers Allegedly Accessed Sensitive Personal Information

According to the lawsuit, hackers infiltrated Air France’s network and gained access to personally identifiable information, including names, addresses, and other sensitive records. 

The plaintiffs say the airline failed to take basic steps to protect its servers, leaving confidential customer information vulnerable to misuse and identity theft.

The filing contends that Air France did not immediately notify those affected once the breach was discovered. Plaintiffs argue that the delay prevented customers from taking timely steps to secure their financial accounts and credit profiles. 

“Defendant’s failure to timely report the data breach makes victims vulnerable to identity theft without any warnings to monitor their financial accounts or credit reports,” the complaint states.

Plaintiffs Say Air France Delayed Warning Victims of the Breach

The plaintiffs assert that Air France failed to properly train employees on cybersecurity protocols or monitor how third-party vendors handled customer data. The lawsuit claims the airline lacked appropriate oversight of agents and contractors who processed passenger information, contributing to the breach.

“Plaintiffs and members of the proposed class trusted Defendant with their PII. But Defendant betrayed that trust,” the filing alleges.

The complaint outlines several causes of action, including negligence, negligence per se, breach of implied contract, unjust enrichment, invasion of privacy, and breach of fiduciary duty. It also cites violations of California’s Unfair Competition Law, Consumer Privacy Act, and Customer Records Act.

One central argument in the complaint is that Air France allegedly failed to inform customers quickly enough after learning of the breach. Allison and Soofiani argue that Air France benefited financially by collecting customer data without investing adequately in systems to secure it. 

The lawsuit claims this imbalance left consumers to bear the risk and cost of potential identity theft, credit monitoring, and fraud prevention.

Cybersecurity Lawsuits Increasing Across Industries

The Air France lawsuit arrives amid a broader wave of litigation targeting companies for failing to protect personal data. Airlines, banks, and financial institutions have become frequent subjects of consumer privacy lawsuits following breaches that expose sensitive information to cybercriminals.

Earlier this year, Capital One faced a similar case after a former employee allegedly accessed and stole customer data from its internal systems. The breach reportedly compromised information including Social Security numbers, addresses, and transaction records for thousands of customers over a nine-month period.

In the Air France data breach class action lawsuit. Allison and Soofiani are seeking to represent both a nationwide class and a California subclass of individuals whose data was allegedly compromised. 

They are suing for injunctive relief requiring the airline to strengthen its cybersecurity measures, improve employee training, and implement better oversight of third-party service providers. 

Their lawsuit also demands the establishment of a fund to reimburse affected customers for credit monitoring, fraud prevention, and related expenses.

Case Details

• Lawsuit: Allison, et al. v. Air France
• Case Number: 2:25-cv-04873
• Court: U.S. District Court for the Eastern District of New York

Plaintiffs' Attorney

• Linda H. Joseph (Schroder, Joseph & Associates LLP)
• Raina Borrelli and Samuel J. Strauss (Strauss Borrelli PLLC)

Has your travel data ever been compromised in a breach? Share your experience in the comments.