LATAM Airlines Brasil confirmed on the evening of August 19, 2026 that unauthorized parties queried its Latam Pass loyalty system and viewed personal and partial payment card data belonging to what the company calls "a limited portion" of members. The airline says the incident was identified on July 29, 2026, three weeks before public disclosure, and that the delay was spent on technical analysis to determine which customers and which fields were affected (G1, Café com Bytes). LATAM notified Brazil's Autoridade Nacional de Proteção de Dados (ANPD) and the potentially affected customers under the LGPD. It has not disclosed how many members were hit. Latam Pass is the largest loyalty program in South America, sized at "more than 50 million" members by Agência Brasil and at approximately 54 million by Tech Times, so the absent denominator is doing a lot of work in the phrase "limited portion."
What Happened
Accounts across Brazilian and international coverage converge on a consistent timeline. The intrusion was detected on July 29, 2026. Disclosure came via email to affected customers and a press statement on Wednesday, August 19 (Folha de S.Paulo, G1, O Globo). By August 20 the story had broadened into consumer-protection coverage, and by August 21 into technical analysis of the payment data specifically (Tech Times).
Where the accounts differ is on detail granularity at the moment of disclosure. Folha, reporting the night of August 19, stated that the company disclosed neither the size of the leak nor which data fields were exposed. Agência Brasil said the same on August 20. G1, O Globo, Café com Bytes and Tech Times, working from the customer notification email rather than the press statement alone, published a specific field-level inventory. The most likely reading is that the customer notification was more detailed than the initial press release, and the field list entered the public record through recipients rather than through a company-wide statement. That distinction matters: the granular list is well corroborated across four outlets, but it originates in individual notifications, not a published breach notice.
LATAM's own statement, as carried by TI INSIDE, describes the containment response: "we blocked the suspicious IP addresses, corrected the system code, and applied additional cybersecurity safeguards. Simultaneously, we adopted advanced solutions to protect against automated access and notified the National Data Protection Agency (ANPD)."
What Was Taken
The field inventory reported by G1, O Globo, Café com Bytes and Tech Times, drawn from LATAM's notification to affected members, covers three categories.
Identity data: full name, date of birth, email address, telephone number, and home address.
Loyalty account data: Latam Pass membership number, program tier or category (Tech Times specifies the Gold, Platinum, Black and Black Signature levels), mileage balance, and qualifying points.
Payment card data: the first six and last four digits of linked credit cards, the card brand, the cardholder name, and the card expiration date.
Note that TI INSIDE's rendering of the exposed set omits email address, home address and the card fields, listing only name, date of birth, telephone, membership number, category, mileage balance and qualifying points. Given that four other outlets working from the same notification include the address and card fields, and that LATAM's own denial is narrowly scoped to full card number, CVV, passwords and bank details rather than to card data generally, the broader list is the safer operating assumption for defenders.
On volume, no source provides a figure. LATAM has not published one, and every outlet in this set explicitly notes the absence. Reports on program size range from "more than 50 million" members (Agência Brasil) to approximately 54 million (Tech Times), but neither figure is a victim count and should not be treated as one.
What LATAM says was not exposed, consistently across all sources: full card numbers, CVV security codes, account passwords, and bank details.
Why It Matters
The airline's framing leads with what was not taken. That framing understates the risk, and Tech Times makes the sharpest version of the argument: the combination of BIN, last four digits, card brand, cardholder name and expiry date is precisely the dataset that supports high-conviction impersonation fraud, per a NordVPN analysis of BIN attack methods that the outlet cites. This is a single OTHER-tier source making the analytical claim, but the underlying reasoning is standard payments-fraud tradecraft rather than a novel assertion.
The first six digits identify the issuing bank. A caller who can name a member's bank, the last four digits of the card on file, the expiry date, the home address, the loyalty tier and the exact mileage balance does not need a full PAN. They need the victim to read back an SMS token, and every one of those data points is a credential of familiarity that makes the request sound legitimate. LATAM's own guidance implicitly concedes this: the company warns members to distrust emails, WhatsApp messages, SMS and calls that reference balances, categories or personal data in order to request payments, transfers, passwords or confirmation codes, and states plainly that "LATAM never requests access passwords, tokens sent via SMS, or complete credit card information by phone or messaging apps."
Loyalty programs are an underdefended asset class. Mileage balances are liquid, transferable, and rarely protected by the fraud controls that guard the payment rails they sit next to. A tier and balance figure also functions as a wealth and travel-frequency proxy, which lets an attacker prioritize targets.
This is also not LATAM's first exposure. Folha notes that in 2021 an attack on SITA, an aviation-sector technology supplier, stole names, membership numbers and tier data belonging to LATAM customers. The current incident sits in a wider Brazilian pattern as well, with TI INSIDE placing it alongside a recent iFood incident that exposed names and CPF tax identification numbers.
The Attack Technique
No source names a threat actor, and no ransomware group or extortion claim has surfaced in this reporting.
What can be inferred comes from LATAM's containment description and the language used to characterize the access. G1 describes "consultas não autorizadas" against the Latam Pass system, unauthorized queries rather than a bulk database exfiltration. LATAM's remediation was to block suspicious IP addresses, correct system code, and deploy defenses "against automated access." Read together, that points strongly toward an application-layer flaw in a member-facing lookup or account endpoint being enumerated at scale, whether through a broken access control that let one authenticated session read other members' records, a parameter-tampering issue, or credential-based access replayed against an unrate-limited API. The explicit mention of correcting system code rules out a purely credential-stuffing explanation, since a stolen-password attack does not require a code fix. Treat this as inference from the company's own remediation list, not as a confirmed root cause.
On the regulatory side, LATAM confirms it notified the ANPD. Tech Times reports that the ANPD has opened a probe. Folha, reporting earlier, stated that the ANPD had not yet commented, and Agência Brasil described the regulator's next step prospectively: it is expected to assess severity and decide whether to require further action, such as compelling wide public disclosure. Only one OTHER-tier source asserts an active investigation, so it should be tracked as reported rather than treated as established. The regulatory exposure is real regardless, because the LGPD requires a notification to describe the affected data, the people involved, the security measures in place, the risks, and the mitigation steps, and LATAM's public posture has so far withheld the scale figure that any severity assessment turns on.
What Organizations Should Do
Stop treating tokenized or truncated card data as non-sensitive. BIN plus last four plus expiry plus cardholder name is a social engineering kit. Classify it accordingly in your data inventory, apply the same access logging and export controls you apply to full PANs, and mask the BIN in application responses unless a specific business function requires it.
Rate-limit and anomaly-monitor every member lookup endpoint. The signature here is high-volume authorized-looking queries from a narrow IP set. Alert on per-account, per-session and per-IP read velocity against customer record endpoints, not just on failed authentication.
Audit loyalty and rewards platforms as tier-one systems. They typically hold identity, contact, partial payment and behavioral data at full population scale while inheriting weaker controls than core booking or payment systems. Run authorization testing specifically for horizontal privilege escalation, where a valid session can enumerate other members' identifiers.
Pre-write the disclosure, including the number. LATAM absorbed three weeks of forensic delay and then disclosed without a victim count, which turned a containment story into a transparency story and handed the regulator an obvious opening. Decide in advance what threshold of certainty releases a figure, and publish a field-level inventory in the public notice rather than only in individual emails.
Brief the fraud and contact-center teams before the breach notice goes out. Members who receive a data breach email are primed to answer a call from someone who sounds like the airline. Tighten callback verification, ban token requests over voice channels as policy, and publish that policy in the same notification.
For affected members and the organizations advising them: monitor Latam Pass statements for unexplained mileage movement, enable every available account alert, treat any unsolicited contact referencing your balance or tier as hostile, and never confirm card digits or SMS codes to an inbound caller. Consider re-registering the payment card on file if the exposed expiry date has meaningful runway left.
Sources: Latam Pass Data Breach: Exposed BIN Data Creates Fraud Risk Beyond... | Latam confirms data breach following cybersecurity incident TI INS... | https://www.riotimesonline.com/latam-data-breach-exposed-names-addr... | Vazamento de dados na Latam: veja o que foi exposto e como se prote... | Latam confirma vazamento de dados de clientes de programa de fideli... | Latam: dados de clientes são vazados - 19/08/2026 - Economia - Folha | LATAM Pass sofre incidente de segurança e expõe dados pessoais e in... | Latam comunica vazamento de dados em programa de fidelidade Radioa...