Air Miles España (Travel Club) Data Breach
The November 2025 Air Miles España (Travel Club) data breach occurred when the enterprise infrastructure of Air Miles España, S.A. (travelclub.es), operator of Spain's preeminent coalition loyalty rewards platform Travel Club, was compromised by the Everest ransomware group.
Exposed Data Types
3- Email addresses
- Account identifiers
- Loyalty data
About This Breach
After failed extortion attempts, customer datasets were disseminated across dark web forums.
What information was affected in the Air Miles España incident?
The compromised Salesforce Marketing Cloud (SFMC) telemetry exports (SFMCM_T950TIT_INHIBICION_EMAIL) encompass marketing permission and communication databases. The incident exposed records for 231,939 unique verified customers, compromising:
- Contact Details: Verified canonical email addresses.
- Account & Loyalty Identifiers: Internal account numbers (IDCUENTA) and customer profile references.
- Marketing & Telemetry Flags: Communication suppression (inhibition) timestamps and notification statuses.
How many accounts were affected?
Strict RFC canonical validation and deduplication confirmed 231,939 unique valid email addresses across more than 4.4 million transaction entries.
Technical analysis and security risks
The Everest syndicate claimed to have exfiltrated over 131 GB of sensitive enterprise data. Exposing verified email addresses alongside loyalty account telemetry enables threat actors to deploy targeted social engineering attacks, such as fraudulent "points expiring" or fake travel voucher phishing campaigns aimed at harvesting banking credentials.
Recommended actions for affected users
Members of Spain's Travel Club program should:
- Exercise extreme caution regarding unsolicited emails claiming that loyalty points or rewards require immediate re-verification.
- Never enter credentials through links received via unsolicited emails or SMS messages.
- Ensure multi-factor authentication (MFA) is enabled on all primary email services.
Verification and editorial method
LeakData compares the incident name, date, affected-record count, and exposed data types with accessible sources. Unverified fields are not presented as facts, and records are updated when new evidence becomes available.
Report missing or incorrect information
