United Airlines united.com United Airlines data breach 2015: what happened and what to do
United Airlines told MileagePlus members in January 2015 that someone had used login details from another breach to get into their accounts from December 9, 2014. United said fewer than 3 dozen of its 95 million accounts were affected.
View all 13,177 breaches- Breach date
- 9 Dec 2014
- Made public
- 6 Jan 2015
- Last updated
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
What happened
United Airlines reported a MileagePlus account incident to the California Attorney General on January 6, 2015. The unauthorized access began on December 9, 2014. United said the person used login credentials taken from a breach somewhere else, and that its own systems had not been breached.
What was exposed
According to the notification, the person could see MileagePlus numbers, account balances and Premier status. Mailing addresses and the last four digits of card numbers may also have been visible. United said fewer than three dozen of its roughly 95 million MileagePlus accounts were affected and that those accounts were temporarily suspended.
What it means for you
This is credential stuffing: criminals take email and password pairs from one breach and try them on other sites. It works because people reuse passwords. Loyalty accounts matter because miles can be spent or transferred like cash.
What United did
United temporarily suspended the affected accounts and notified the members involved. The company's position was that the login details came from a third-party breach, so the fix on your side is the same as after any credential leak: a password you use nowhere else, plus two-factor login.
A separate later incident
Coverage from May 2015 describes a different United incident involving flight records. It isn't the same event as this notice.
Sources checked: scworld.com, oag.ca.gov
Last verified against the official page:
What to do if you were in it
- 1
Use a unique password on every account
Change your MileagePlus password and any other account that shares it. A password manager makes unique passwords easy.
- 2
Turn on two-factor login
Use an authenticator app or passkey where the site offers it. It stops most takeovers even when a password has leaked.
- 3
Check your miles and statements
Look for activity you don't recognize in your loyalty account and on your card statements, and report it to the airline and your card issuer.
- 4
Expect travel scams
Be wary of emails and texts about your flights or miles. Go to the airline's site yourself instead of clicking links, as the FTC advises.
- 5
Check whether your details are in other breaches
Run a free Serus scan to see whether your email or phone number shows up in this and other breaches. Serus monitors breach databases and the dark web and alerts you when your data appears; it can't remove data from a breach.
Official filings
- California Attorney General , filed 6 Jan 2015
Timeline
-
The breach happened
-
The company made it public
-
Reported to the California Attorney General
Frequently asked
Was I affected by the United Airlines breach?
United said fewer than 3 dozen MileagePlus accounts were affected and notified those members. If you got no notice, your account wasn't among them.
What was exposed?
MileagePlus numbers, account balances and Premier status, and possibly mailing addresses and the last four digits of card numbers.
Was United itself hacked?
United said it had not been breached. It said the access came from login credentials taken in another breach.
Should I change my password?
Yes, if you reuse it anywhere. Use a unique password and turn on two-factor login.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
