Air France Data Breach Lawsuit: What Exists, What Was Dropped, What Is New
Active Litigation
Two separate incidents carry the Air France name. In August 2025, Air France and KLM said an external customer-service platform was breached and customer contact and Flying Blue data was accessed. In October 2026, Air France-KLM confirmed unauthorized access to internal folders after a hacking group claimed it had airline files. As of October 18, 2026, there is no Air France settlement, no claim form, no deadline and no payment. The only US class action against the airline was voluntarily dismissed in December 2025.
Questions about this case?
AI Legal Assistant · free · answers in seconds · general information, not legal advice
Independent information service: Settlement Insight is not the settlement administrator, is not affiliated with or endorsed by the company named above, and is not a law firm. Submitting this form does not file a claim — it shares your information with our participating legal intake partners, who may contact you about your options.
What Happened, and What the Lawsuit Alleged
On August 6, 2025, Air France and KLM said they had “detected unusual activity on an external platform we use for customer service. This activity resulted in unauthorized access to customer data.” The airlines said their internal systems were not affected.
According to the airlines’ statements as reported, the exposed fields were first and last name, contact details, the subject lines of service-request emails and Flying Blue loyalty numbers. KLM added that notes written by its customer-service agents may have been seen. The airlines said passwords, travel details, miles, passport data and credit card information were not taken. They did not disclose how many customers were affected. Security reporters tied the incident to a wider wave of attacks on companies’ Salesforce customer databases; Air France-KLM declined to confirm the platform.
The US air france lawsuit that followed alleged the airline failed to use reasonable security, failed to train staff and monitor vendors, and was slow to warn customers. It pleaded negligence, negligence per se, breach of implied contract, unjust enrichment, invasion of privacy, breach of fiduciary duty and California privacy and unfair-competition claims. Those were allegations; no court ruled on them.
Case details
United States. Two customers filed Allison, et al. v. Air France, No. 2:25-cv-04873, in the U.S. District Court for the Eastern District of New York on September 3, 2025, seeking a nationwide class and a California subclass. Federal case data shows a case with the same caption opened in the Southern District of New York on September 15, 2025, No. 1:25-cv-07634. Bloomberg Law reported on December 2, 2025 that the plaintiffs had filed a notice of voluntary dismissal in the Southern District of New York that Monday.
The vendor case. On December 16, 2025 the Judicial Panel on Multidistrict Litigation declined to create one Salesforce-wide MDL (MDL No. 3164). A separate proposed class action against Salesforce itself, In re Salesforce Customers Security Incident Litigation, No. 3:25-cv-07232-JSC, is pending in the Northern District of California before Judge Jacqueline Scott Corley. We could not confirm that Air France customers are part of it. Our Salesforce data breach page tracks that case.
Canada. On August 14, 2025 a proposed class action was filed in the Supreme Court of British Columbia, Vancouver Registry, Court File No. VLC-S-S-256131, against Société Air France, KLM, Air France-KLM Group and Salesforce. It proposes a worldwide class. It has not been certified.
Status: No Settlement, No Claim Form
What is still open: the Canadian proposed air france class action, where the last public update was a case planning conference set for May 26, 2026 to request a judge; and the Salesforce case in San Francisco, where Judge Corley let most claims proceed in September 2026 and signed a schedule through class certification on October 14, 2026.
Why people are searching now: City AM reported on October 12, 2026 that a hacking group claimed to have Air France-KLM data. The airline confirmed it “recently detected unauthorised access to internal folders that did at this stage, not contain any sensitive data” and said the incident “does not affect customers.” The screenshots appeared to show files of current and former employees. We found no lawsuit over this incident.
Follow this case
There's no claim deadline yet. We'll email you if a settlement opens a claim period.
Who Is Affected
August 2025 incident: Air France and KLM customers whose records sat on the external customer-service platform — in practice, people who had contacted customer service and Flying Blue members. The airlines said they were informing affected customers directly. If you received that notice, keep it; it is the best evidence of which fields were involved.
October 2026 incident: the airline says customers are not affected. The material shown by the attackers appeared to relate to employees. Treat the attackers’ claims about customer data as unverified claims.
There is no US class to join. The US case was dismissed before any class was certified. The Canadian claim proposes a class of everyone, anywhere in the world, whose data was compromised in the breach discovered on or about August 7, 2025, but a court has not approved that class.
Is There Any Money?
The data involved matters for what a future case could be worth. The airlines said no passwords, passport numbers or credit cards were taken — the exposure was names, contact details, Flying Blue numbers and support-ticket subject lines. Breach settlements usually pay most for documented losses tied to Social Security or card data; contact data alone tends to produce smaller results. For how breach settlements are typically structured, see our data breach settlement calculator. For an airline case that did reach a settlement, see our report on the Delta Air Lines settlement — a different case, not a data breach.
How cases like this one end
Our copy of the federal courts’ own case database covers 129,730 other contract casesclosed in U.S. federal district courts between 2015 and 2026, 6% of them filed as class actions:
- 30.7% ended in a settlement recorded by the court. Another 20.2% were dismissed voluntarily, which often follows a private settlement — so the real settlement share sits between 30.7% and 50.9%.
- 7.5% were decided on a motion before any trial.
- 1 in 72 reached a trial (1.4%), after a median of 29.3 months.
- Median time from filing to the end of the case: 7.6 months.
- Only 7,691 of them (5.9%) record a money award at all; the median of those is $407,000.
These are base rates for this type of case (federal other contract cases) — not a prediction about this lawsuit, and not legal advice. Source: Federal Judicial Center, Integrated Database (civil), analysed by Settlement Insight. Cases heard in state courts are not included.
Air France Data Breach Timeline
August 6, 2025 — Breach Disclosed
Air France and KLM say an external customer-service platform was breached. Names, contact details, Flying Blue numbers and email subject lines were accessed. Reported to the CNIL and the Dutch Data Protection Authority.
August 14, 2025 — Canadian Claim Filed
A proposed class action is filed in the Supreme Court of British Columbia against Air France, KLM, Air France-KLM Group and Salesforce (VLC-S-S-256131).
September 3, 2025 — US Class Action Filed
Allison v. Air France, No. 2:25-cv-04873, is filed in the Eastern District of New York, seeking a US class and a California subclass.
December 2025 — US Case Dropped
The plaintiffs file a notice of voluntary dismissal in the Southern District of New York, reported December 2, 2025. On December 16, 2025 the JPML declines a Salesforce-wide MDL.
October 12, 2026 — New Incident Reported
A hacking group claims Air France-KLM files. The airline confirms unauthorized access to internal folders and says customers are not affected.
As of October 18, 2026 — No Settlement
No Air France settlement, claim form or deadline exists. The Canadian claim is uncertified; the Salesforce case is heading toward class certification.
Three Things to Watch For
The stolen fields were exactly what a convincing fake airline message needs:
Emails quoting your Flying Blue number
Attackers took Flying Blue numbers and support-ticket subject lines. A message that quotes your number or an old complaint is not proof it is from Air France. Log in through the app or the address you typed yourself, never through the link.
“Claim your Air France breach compensation”
There is no settlement and no claim form. A page asking for card details, a passport scan or a “processing fee” to release breach money is the scam, not the remedy.
Calls from “customer service” about a refund or rebooking
Your contact details and the topics of past requests were exposed, so a caller can sound informed. Hang up and call the number on the official website. The airlines told customers to be alert for suspicious emails and phone calls.
Air France Data Breach — Questions People Actually Ask
Short answers to the questions people ask most about this case.
Do I get compensation for the Air France data breach?
Not at this point. As of October 18, 2026 there is no settlement, no fund and no claim form for either the August 2025 or the October 2026 incident. The only US class action was voluntarily dismissed in December 2025.
Is there an Air France class action I can join?
Not in the US. A proposed class action is pending in British Columbia, Canada (VLC-S-S-256131) and proposes a worldwide class, but it has not been certified. The scope of the class, and whether anyone would need to take a step to be included, would be decided by the court if a class is ever certified.
What data was exposed?
In August 2025: first and last name, contact details, Flying Blue number, the subject lines of service-request emails and, per KLM, agent notes. The airlines said passwords, travel details, miles, passports and credit cards were not taken.
How do I know if my data breach letter is real?
The airlines said in August 2025 that affected customers were being informed directly and should be alert for suspicious emails or calls. A real notice explains what happened; it does not ask for your password, card number or a fee. Check by logging in to your account yourself rather than using a link in the message.
How do I find if my data was breached?
For the August 2025 incident, the airlines notified affected customers themselves. If you contacted Air France or KLM customer service or are a Flying Blue member and received no notice, contact the airline directly through its official website. For the October 2026 incident, the airline says customers are not affected.
What happened in October 2026?
City AM reported on October 12, 2026 that a hacking group claimed Air France-KLM data. The airline confirmed unauthorized access to internal folders that, at that stage, held no sensitive data, and notified authorities. The screenshots appeared to show employee files. No lawsuit has been reported.
Is it safe to fly with Air France now?
This page covers data, not flight safety. Air France-KLM said the October 2026 incident does not affect customers, service continuity or its links to partner systems, and the August 2025 breach involved a customer-service platform, not operational systems. For flight operations, use the airline’s own notices.
What about KLM data breach compensation?
The same August 2025 incident hit KLM, and the answer is the same: no settlement and no claim form. KLM is named in the Canadian claim alongside Air France, Air France-KLM Group and Salesforce.
About This Information
Editorially Reviewed — Content reviewed for accuracy using published legal research, government data, and verified court records. See our methodology. Reviewed by Leonard Goldberg, Editor · Last updated - $236 billion in real payouts analyzed · See what we found
This page is for general information only and is not legal advice. Lawsuit status, eligibility, and compensation can change. Settlement Insight is not a law firm and does not represent any party. Consult a licensed attorney about your specific situation.
Related Consumer Brand Lawsuits
Other cases and free tools — not about this case.
Similar cases we track
- Salesforce Data Breach LawsuitsThe vendor-side case in San Francisco and where client suits went
- Open Class Action SettlementsSettlements taking claims right now, with deadlines
- Data Breach Settlement CalculatorWhat comparable breach settlements have paid per person
- Settlement Payout CalculatorEstimate a share once a fund and claim rate are known