Transavia Airlines C.V.

Transavia Airlines suffered a 2019 data breach in which hackers compromised employee login credentials and accessed the personal data — names, dates of birth, and flight reservation details — of approximately 25,000 passengers and crew members. The AP found Transavia had failed to implement multi-factor authentication on employee systems with access to passenger records, a standalone violation of GDPR Art. 32 independent of the breach itself. The absence of this basic control was found to have directly enabled the compromise.