airBaltic data incident affects 618,000 passenger bookings

Unauthorised access to an external IT provider’s systems exposed information from about 618,000 airBaltic passenger bookings, the Latvian airline told LSM. The airline said its own IT systems were not affected.

The bookings belonged to passengers who checked in online for airBaltic flights between July 18 and November 12, 2026. The accessed information included passengers’ names, booking references and flight details. Payment information, travel document data and other sensitive information were not affected, the airline said.

About 11,800 affected bookings are for flights that have not yet taken place. That figure may change as the investigation continues. So far, there is no indication that the data has been misused.

As a precaution, airBaltic has disabled booking management and online check-in for affected bookings to prevent unauthorised access or changes. Affected passengers can check in at the airport free of charge. Passengers who did not check in online during the period from July 18 to November 12 can continue to manage their bookings and check in online as usual. Flights are operating on schedule, the airline said.

AirBaltic is working with the service provider to contain the incident and reduce risks to passengers. The airline told LSM the incident is unrelated to recent reports of a text-message data leak from the Latvian database of a branch of telecoms provider CSCTelecom.

The airline said the accessed information could potentially be used in fraudulent messages impersonating airBaltic or other travel providers, or in attempts to access and change bookings.