Skip to content
Today
Sign in

LeadershipNot yet confirmed elsewhere1 publisher2 min readPublished

Air France-KLM confirms a breach the Asos attackers say is theirs

Air France-KLM confirmed to City AM that unauthorised access reached internal folders despite mandatory multi-factor authentication. The airline did not name an attacker, so the tie to Xuanye Group, the Asos claimant, rests on the group's own posts.

The Board Room · Leadership desk

How we use AISend a correction

Illustration accompanying Air France-KLM confirms a breach the Asos attackers say is theirs
Generated illustration
Airline and Asos confirm access; H&M finds none What each party says, as reported by City AM. The report gives no figures to chart, so the map sets out each account.

Air France-KLM reports unauthorised access to internal folders. Asos says hackers tricked an employee into giving login details. H&M, named in online claims, says it has not detected a breach. Xuanye Group posted a screenshot of files appearing to belong to airline employees.

Airline and Asos confirm access; H&M finds none
WhoHowKindClaim
Air France-KLMIT teams detected unauthorised access to internal folders despite mandatory MFAexposure2
AsosSays hackers posed as a 'trusted contact' and tricked an employee into giving login detailsexposure6
H&MThe Times reports online claims Xuanye Group hacked H&M; H&M says it has not detected a breachcontradiction14
Air France-KLM employeesXuanye Group posted a Telegram screenshot of files that appeared to be owned by themexposure12

What happened

  • Xuanye Group posted a Telegram screenshot of files that appeared to belong to current and former Air France-KLM employees.
  • The airline said the incident does not affect customers, service continuity, or the interfaces between its systems and those of partners and suppliers.
  • The Asos app notification that threatened a leak of its Snowflake instance linked to the same Telegram channel where the airline data later appeared.
  • Asos said its intruders posed as a trusted contact and tricked an employee into handing over login details.
  • Air France-KLM was breached once before, in August last year, when ShinyHunters reached a third-party customer service platform used by its contact centers.

Why it matters

  • decision A security lead at another consumer brand must choose this quarter between tracking Xuanye Group as a named actor on a two-company link and waiting for a third confirmation. Tracking spends attention on an unproven pattern; waiting gives up lead time if the pattern is real.
  • contradiction The airline's statement leads with mandatory MFA, while the only method described anywhere in this cluster is an Asos employee deceived into giving up a login. An MFA coverage figure tells a board little about that route until the airline says whether its intruders used it.
  • exposure In our view, internal folders and a third-party contact-centre platform are separate surfaces, so remediation after the ShinyHunters incident would not by itself have covered this one.

The link between the two incidents is a Telegram channel. The notification published from the Asos mobile app pointed to it, and the Air France-KLM files were shared there afterwards [5]. Xuanye Group also told City AM that the files relate to the airline [13]. The airline confirmed a breach [1], but its statement as City AM printed it does not say how the intruders got in [16].

H&M is where the pattern thins. The Times reported that claims were circulating online that Xuanye Group had hacked the retailer [14]. H&M said it is investigating [17]. Its spokesperson said: "To date, we have not found any indications that our IT environment has been compromised." [15] Of the three companies tied to the group in City AM's report, two have acknowledged an intrusion and one has found nothing [11].

We think the supportable reading is narrow: a confirmed intrusion at a retailer, a confirmed breach at an airline, and a shared channel connecting them. A campaign across consumer brands needs a third confirmation that does not yet exist. The group's own Telegram posts say it holds Asos customer information that "will not be touched for a designated period" [9], so any escalation there is on the group's schedule.

The airline's wording is also time-limited. It said the folders did "at this stage, not contain any sensitive data" [10], and that its IT departments immediately secured them and notified the relevant authorities [4]. If that finding changes, the employee files in the screenshot are where the next disclosure would start [12].

What to watch

  • Whether Air France-KLM discloses how the intruders got in, and whether its review changes the finding that the folders held no sensitive data.
  • The outcome of H&M's investigation into the claims, which would turn a two-company link into a three-company one or leave it at two.
  • Whether Xuanye Group leaks the Asos customer data once the 'designated period' it described on Telegram ends.

Clarity's read

What the record supports and how the coverage leans. The claims behind it follow.

Reality

Evidence50
Adoption
Insufficient
Hype gap+10
Incentives65
Confidence45
Why these scores

Claim ledger

Ranked by verification strength, evidence, and original report placement.

  1. [1]

    Air France-KLM confirmed to City AM that it recently detected a data breach.

    ReportedSupportedSource: City AM, citing Air France-KLMView cited source
  2. [2]

    An Air France-KLM spokesperson said that, although protected by mandatory multi-factor authentication, the group's IT teams recently detected unauthorised access to internal folders.

    ReportedSupportedSource: Air France-KLM spokesperson, quoted by City AMView cited source
  3. [3]

    Air France-KLM said the incident does not affect customers, service continuity, or the interfaces between its information systems and those of its partners and suppliers.

    ReportedSupportedSource: Air France-KLM spokesperson, quoted by City AMView cited source

Sources

1 independent publisher whose own reporting we read for this story.

  1. cityam.com

    1 article · October 12, 2026

    Asos hackers claim responsibility for Air France-KLM data breach

Share your take

Let Clarity write the post for you.

Signed-in readers get a short post drafted on this story in the register they choose — narrative, analytical, or a direct position — editable to the last word before it goes anywhere. The share buttons at the top of this story work without an account.

Create a free account to composeSign in

Topics and entities

Follow any of these and your For You feed starts watching them — no settings page required.

Topics

Entities

Loading related stories