TAP Air Portugal ransomware breach

On 26 August 2022, TAP Air Portugal — Portugal's state-owned flag carrier — confirmed it had been hit by a cyberattack overnight. What the airline initially described as a contained, blocked intrusion turned into the largest customer-data leak in Portuguese aviation history once the Ragnar Locker ransomware gang published hundreds of gigabytes of stolen records weeks later.

What happened

According to TAP, attackers struck its infrastructure on the night of 25 August 2022. The airline activated its security mechanisms, said it had blocked unauthorized access, and reassured passengers that flight operations and safety were unaffected. Crucially, TAP's first statements asserted that "no facts have been found that allow us to conclude that there has been improper access to customer data."

That position did not hold. On 31 August, the Ragnar Locker ransomware operation publicly named TAP on its leak site, claiming it had penetrated the airline's network, stolen customer information, and posted a screenshot of sample records loaded with personally identifiable information. The group framed the airline's downplaying of the incident as a deception of its own customers — a hallmark double-extortion pressure tactic.

Impact

Beginning around 21 September 2022, Ragnar Locker started releasing the data it had exfiltrated:

• A trove of roughly 581 GB of files covering approximately 1.5 million customers.
• Exposed fields included names, dates of birth, genders, nationalities, email addresses, telephone numbers, physical addresses, salutations and spoken languages.
• When the dataset was indexed by Have I Been Pwned on 23 September, it contained over 5 million unique email addresses and affected roughly 6.08 million accounts in total.

No facts publicly confirm that ransomware encrypted core systems or grounded flights; the damage was overwhelmingly a confidentiality breach. TAP and Portugal's data-protection authority (CNPD) treated the exposure as a major personal-data incident requiring customer notification.

Attribution

Ragnar Locker was a well-established ransomware-as-a-service operation known for targeting critical infrastructure and large enterprises, and for its aggressive naming-and-shaming leak site. The gang's infrastructure was later disrupted in an international law-enforcement takedown in October 2023, with arrests in several countries.

Why it matters

The TAP breach is a textbook example of the gap between "attack blocked" and "data safe." TAP's early reassurances aged badly the moment the attacker published proof of exfiltration, eroding customer trust and inviting regulatory scrutiny. For a national carrier handling millions of frequent-flyer and booking records, the episode underscored that ransomware crews increasingly monetize stolen data through publication and extortion even when victims refuse to pay — and that incident communications must account for the possibility that the intruder, not the victim, controls the narrative.