On May 21, 2021, Air India disclosed that a cyberattack had compromised personal data for approximately 4.5 million customers worldwide. The affected records covered registrations made between August 26, 2011, and February 3, 2021. Reported information included names, dates of birth, contact details, passport information, ticket data, Star Alliance and Air India frequent-flyer records, and credit-card information.
The incident was significant because it combined identity documents, travel histories and loyalty-program data over nearly a decade, creating risks beyond ordinary account takeover. The source does not identify the intrusion method, a named attacker, the specific executives responsible, or a final regulatory penalty. It also does not establish whether every listed category was accessed in usable form. Nevertheless, the breach demonstrated the concentration of sensitive passenger information in airline reservation and loyalty systems and expanded the privacy consequences of a compromise from isolated credentials to long-term travel and identification records.
