How a Ransomware Attack on Viva Air Exposed 12.3 Million Records

In March 2022, the Colombian airline Viva Air suffered a serious data breach that exposed the personal information of over 12.3 million customers. The breach occured alongside a ransomware attack against the airline, which has since ceased operations, leaving millions of passengers with little recourse. The leaked data spans records dating from 2015 to 2021, suggesting the airline's customer database was accessable to attackers for an extended period.

What Attackers Can Do With Stolen Airline Passenger Data

With full names, email addresses, phone numbers, birthdays, and gender data in hand, attackers are partcularly well-positioned to launch targeted phishing campaigns, commit identity fraud, and build convincing social engineering attacks against victims. Even without passwords in this dataset, the combination of personal identifiers is enough to open fraudulent accounts or access other services where victims reused information.

What Was Exposed in the Viva Air Breach

• Email Address
• Phone Number
• First Name
• Last Name
• Gender
• Birthday

Why This Breach Still Matters Years Later

Breached data does not expire. Records from this 2022 incident continue to circulate on dark web forums and are combined with data from other breaches to build more complete profiles of individuals. Victims who recieved no notification from the now-defunct airline remain unaware their data is in criminal hands, making them more vulnerable to account takeover and fraud attempts today.

How a Database Breach Works

A database breach occurs when attackers gain unauthorized access to a structured data repository, often through exploiting unpatched software vulnerabilities, stolen credentials, or misconfigured cloud storage. In incidents linked to ransomware, attackers frequently exfiltrate data before encrypting it, giving them a second lever for extortion. The data is then sold or published on dark web marketplaces, where it can be purchased by anyone with the means to pay.

Check If Your Data Was Exposed

HEROIC's dark web monitoring database contains over 400 billion exposed records, including data from the Viva Air breach. Search your email address now to find out if your personal information has been compromised and take steps to protect yourself before attackers do.