Pegasus Airlines · Breach

Actor claims theft of 173 GB from Pegasus Airlines

Nov 04, 2026 · 1 min read

A threat actor claims on a dark web forum access to Pegasus Airlines' Jira and Confluence servers, and later its AWS environment. The roughly 173 GB package would include 430K support tickets, 37K internal files, data on 18K employees, and customer records with PNR, national ID and passport numbers. The claim, reported by DailyDarkWeb, is unverified; if confirmed, phishing with real booking details and KVKK and GDPR notification duties may apply.

By HIFY Radar newsroom Updated 11/04/2026 05:17 AM Get this every day →← Back to the feed 1 source

MediumBreachNo software to update

In this article

What happened
Why it matters
What to do
For the technical team
Timeline
Sources

What happened

A threat actor claims on an underground forum to have breached Pegasus Airlines' Jira and Confluence servers, and later its AWS environment. The 173 GB package would include support tickets, internal files, employee names and emails, and customer booking records. The claim has not been verified by the company or by third parties.

Why it matters

If confirmed, it exposes customer personal data such as national ID and passport numbers, plus real booking details that enable targeted phishing against passengers. The company may face notification duties under Turkey's data protection law (KVKK) and GDPR. Names and emails of 18K employees would also be exposed.

What to do

Monitor an official Pegasus Airlines statement and independent verification before treating this as a confirmed incident. If confirmed, trigger the incident response plan, legal notifications (KVKK, GDPR), and customer warnings about phishing using real booking data.

For the technical team

Affected: Pegasus Airlines, companhia aérea turca; servidores Jira e Confluence e ambiente AWS alegadamente invadidos · Pegasus Airlines, Turkish carrier: Jira and Confluence servers and AWS environment, per the claim.
Exploitation: No technical exploitation described. Breach claim posted on an underground forum and reported by DailyDarkWeb, with no independent verification. The attached screenshot appears to show an internal Jira service desk, with no customer PII visible in the post.
Fix: Not applicable: alleged data breach, no fixable vulnerability cited in the source.
Vector: Alleged initial access to Pegasus Airlines' Jira and Confluence servers, followed by its AWS environment. The source does not describe the intrusion method or prerequisites.
More details: Alleged volumes: about 430K Jira tickets with comments and attachments; 37K Confluence files, including internal employee guides; names and emails of 18K employees; customer data with PNR, flight details, names, national ID and passport numbers, emails and phone numbers; roughly 173 GB total. DailyDarkWeb analyst note: if authentic, passengers face targeted phishing using real booking details, and KVKK (Turkey's data protection law) and GDPR notification duties may apply.