HackingTechnologyInformationCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)Government IDEmploymentMediumContained

FRONTIER AIRLINES, INC.

bd_0974ef8675755c48 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jun 18, 2026

Filed

Jul 9, 2026

To disclose

—

Affected

Not disclosed

Linked

6 filings

Confidence

64%

Full breach record for FRONTIER AIRLINES, INC. →3 incidents on file

Frontier Airlines notified Nebraska AG of a data breach discovered on June 18, 2026. Unauthorized access occurred between May 12 and June 3, 2026, affecting employee and customer data including SSNs, driver's licenses, and passport numbers. The incident is contained. Law enforcement was notified, and a third-party firm investigated. Credit monitoring via Experian was offered.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 37 days

May 12, 2026

Begins

Jun 18, 2026

Discovered

Jul 9, 2026

Filed

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Siteexfilsquadbd_d3b86a21139336662026-07-26 · +17dVerified by operator

Regulatory filings (4) · sorted by filing gap

Vermont State AGbd_3790dc03c624bee32026-07-09Verified
New Hampshire State AGbd_eeea7b4cc582ca0c2026-07-13 · +4dVerified by operator
Texas State AGbd_8051a3d50d06dff82026-07-14 · +5dVerified by operator
Massachusetts State AGbd_e689edfc5b27166b2026-07-14 · +5dVerified by operator

Name: FRONTIER AIRLINES, INC.
norm: frontier airlines
Domain: flyfrontier.com

Name: FRONTIER AIRLINES, INC.
norm: frontier airlines
Domain: flyfrontier.com
Industry: Technologyllm

Discovered: Jun 18, 2026
Breach occurred: May 12, 2026 – Jun 3, 2026
Undetected for: 37 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jul 9, 2026
Affected individuals: Not disclosed
Data types: Identity (basic)Government IDEmployment
Data elements: Social Security numberDate of birth
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: External
Regulator citations: notified law enforcement
Initial access: exploit_public_facing

During the incident: Initiated our incident response protocols
Notified law enforcement
Engaged a third-party cybersecurity firm to conduct a comprehensive investigation
Took steps to secure the account and help prevent a reoccurrence of this type of incident
Strengthening access controls
Improving monitoring of our systems
Implementing other measures to safeguard information and enhance our ability to detect and respond to potential threats
Offering complimentary credit monitoring and other identity protection services through Experian IdentityWorks SM to all Frontier team members potentially affected by this incident
Changes made: Strengthening access controls
Improving monitoring of our systems
Implementing other measures to safeguard information and enhance our ability to detect and respond to potential threats
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Vermont State AGJul 9 · first

Nebraska State AGJul 9 · first · this page

New Hampshire State AG+4d

Texas State AG+5d

Massachusetts State AG+5d

Pattern: first filing Jul 9 (VT), last Jul 14 (MA) — a 5-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://nebraska.gov/ago/data-breach/documents/c125c3b0-3c10-40ff-acc0-a97d6a8a6791.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 9, 2026
Raw hash: 64ad3327da3b951e7efb38a666e77fd6a0469fdc46b50a7acf73d843eee3c0de

Linked disclosures

Ransomware claims (1)

Regulatory filings (4) · sorted by filing gap

Reporting entityFRONTIER AIRLINES, INC.

Victim entityFRONTIER AIRLINES, INC.

Incidentdiscovered Jun 18, 2026

Stated responseInitiated our incident response protocols

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancenebraska.gov