Air France-KLM has confirmed that its IT teams recently detected unauthorized access to internal folders. The airline group says those folders did not contain sensitive data "at this stage." The confirmation came in a statement to City AM, published on 12 October 2026, after the extortion crew calling itself Xuanye Group claimed it had breached the airline and shared what it said were stolen files. This is the same group that claimed last week's compromise of fast-fashion retailer Asos. Air France-KLM says the incident does not affect customers, service continuity, or the links between its systems and those of its partners and suppliers. No record count, file count or data volume has been disclosed by the company or by any source reviewed for this brief.
What Happened
According to City AM, Xuanye Group circulated data last week that it said came from Air France-KLM. On Telegram, the group posted a screenshot of a set of files. City AM reported that the files appeared to be owned by former and current employees of the airline group. The Dutch aviation outlet Airwork, citing BankInfoSecurity, also reports that names visible in the screenshot appear to belong to current or former staff.
An Air France-KLM spokesperson told City AM that the group "continuously monitors all applications and data it uses for both its customers and employees," and that "although protected by mandatory multi-factor authentication (MFA), the group's IT teams recently detected unauthorised access to internal folders." The company says it "immediately secured the affected folders and files and notified the relevant authorities of these attempted accesses."
There are two important gaps in what has been confirmed:
- Attribution is not confirmed by the victim. As both Airwork and The Clarity point out, Air France-KLM did not name Xuanye Group. It also did not say whether the access it detected is the same intrusion the group is claiming. The link between the two rests on the group's own posts.
- Accounts differ on whether a breach has been acknowledged. Cypro's bulletin, dated 12 October, describes the claim as "unverified." It says the airline had not publicly acknowledged a new incident and that its newsrooms carried no advisory. City AM's report of a confirmed statement was published the same day. The likeliest explanation is that Cypro wrote its bulletin before or without seeing the City AM statement. Even so, the airline's acknowledgement appears to have been made only to the press, not in any formal public notice. Cypro's other point still holds: no independent technical analysis has shown where the circulated data came from.
The airline says this incident is separate from its previous one. In August 2025, ShinyHunters accessed a third-party customer service platform used by Air France-KLM's contact centres (per City AM and Airwork).
What Was Taken
What was taken is still poorly defined.
- Company position: the internal folders accessed did not contain sensitive data "at this stage," and customers are not affected.
- Attacker evidence: a single Telegram screenshot showing file listings. The files appear to belong to current and former employees.
- Volume: unknown. Airwork notes it is not known how many files were viewed or exfiltrated. No source gives a record count.
- Indicators: Cypro reports that no IP addresses, file hashes, domains, internal file paths, malware or exploited vulnerabilities have been published for this claim.
The words "at this stage" mean the company's assessment could change as its investigation continues. The fact that the files appear tied to employees suggests any real exposure is more likely to involve staff data than passenger data. That is an inference, not a confirmed finding.
Why It Matters
Xuanye Group is running a fast, high-profile campaign across European consumer brands. Its activity so far:
- Asos (7 October). BankInfoSecurity reports that the group pushed an "ASOS HACKED" alert through the retailer's mobile app to users in the UK, France, Ireland, Sweden and Australia. The alert claimed the group had "fully compromised the Snowflake instance" and demanded that Asos "engage with us, or we will leak it." Asos said it was investigating unauthorized activity involving third-party customer notification platforms. It said basic personal information such as names and contact details may have been accessed, and that it does not believe payment card data was affected.
- Air France-KLM (claimed this week). The group moved from retail to aviation within days.
- H&M (disputed). Sources disagree on who is behind the H&M claims. The Clarity, summarising City AM, says The Times linked online claims about H&M to Xuanye Group. InternetRetailing, citing BBC News, says H&M is investigating claims made by ShinyHunters. Both agree H&M says it has found no sign that its data environment was compromised.
This campaign is taking place alongside a broader wave of attacks. InternetRetailing reports a breach at TFG (Phase Eight, Whistles, Hobbs) on 11 October, and an attack on refrigeration systems at Intermarché and Coopérative U stores in France on 12 October. Nothing in the sources connects either incident to Xuanye Group.
The pattern for defenders is a loud, publicity-driven extortion model. The group uses public channels such as Telegram and hijacked customer-facing apps to pressure victims into negotiating, sometimes before the victim has made any statement of its own. BankInfoSecurity's headline summed up the result at Asos: the company "lost control of its story."
The Attack Technique
Air France-KLM has not said how the attackers got in. It has only said that the affected environment was protected by mandatory MFA. That suggests one of three things: MFA was bypassed, a session or token was abused, or access came through an identity or platform outside the MFA boundary. None of these has been confirmed.
What is known about Xuanye Group's methods comes from the Asos incident:
- Social engineering. According to The Clarity's summary of City AM's reporting, Asos says the attackers posed as a "trusted contact" and tricked an employee into handing over login details.
- Abuse of third-party SaaS. Asos tied the incident to third-party platforms it uses to communicate with customers. The attackers also claimed to have compromised a Snowflake instance.
- Using the victim's own channels for pressure. The group sent push notifications through the compromised platform directly to customers.
This pattern of credential theft through impersonation followed by access to SaaS data stores closely resembles the playbook ShinyHunters-linked actors used in 2024 and 2025. No source reviewed here establishes an organisational link between the two groups.
What Organizations Should Do
- Harden help desk and employee verification against impersonation. Require out-of-band callback verification for any request to reset credentials, enrol a new MFA device or grant access, especially when the requester claims to be a "trusted contact" or vendor.
- Move to phishing-resistant MFA. Air France-KLM's case shows that "mandatory MFA" alone does not stop access. Prioritise FIDO2/passkeys for administrators, file-share users and SaaS data platforms, and alert on new MFA device registrations.
- Review SaaS and data platform access. Audit Snowflake, file-sharing services and customer messaging or notification platforms for stale accounts, accounts that can log in without SSO, overly broad roles and access from unusual IP ranges. Enforce network policies and session lifetimes.
- Secure customer-facing messaging channels. Restrict who can send push notifications or bulk messages, require approval for campaigns, and monitor for unexpected sends. Attackers who control these channels control your public narrative.
- Monitor internal file shares for bulk enumeration and download. Alert when one identity touches large numbers of folders or HR-related files in a short window.
- Pre-stage your extortion response. Prepare holding statements, regulator notification workflows and Telegram/leak-site monitoring in advance. This group publicises its claims before victims speak.
Sources: Air France-KLM confirms data breach after hacker claim | Attackers Hijack Asos App to Say Store is Hacked | Asos hackers claim responsibility for Air France-KLM data breach | Air France-KLM confirms breach claimed by Asos hackers | Air France-KLM Breach Claim Remains Unverified | Air France-KLM bevestigt inbraak interne mappen na claim hackers A... | TFG, H&M and InterMarché all targeted by cybercriminals ... | 🔎 Privacy Policy - Air France KLM Group Kolet Help Center