A data breach affecting Russian airline Utair traces to early 2019, when a MongoDB database operated by the airline's in-house IT division, UTair Digital, was left exposed on the public internet from approximately January 21 to March 21, 2019. The database was identified by Russian leak-intelligence service DLBI, which notified the airline. Utair contained the exposure and characterized it as the result of a server misconfiguration.\n\nThe data initially circulated among threat-actor circles, was offered for sale in August 2019, and was published openly on a hacker forum in August 2020. Have I Been Pwned indexed approximately 401,000 unique email addresses associated with the dataset and added the breach to its public database in late 2025. Original Russian-language reporting put the underlying record count at around 530,000 customer rows. Exposed fields included passenger names in both Cyrillic and Latin characters, email addresses, phone numbers, dates of birth, gender, home addresses, passport numbers, and UTair Status loyalty program details including accumulated miles and tier level.\n\nUtair publicly stated that no payment-card data was compromised and that loyalty accounts remained protected by two-factor authentication. The practical risk to affected passengers is concentrated in identity fraud and travel-related phishing. The combination of passport number, date of birth, and address creates an unusually strong base for international identity-verification bypass. Affected passengers should treat their passport details as exposed, monitor for unusual travel-related contact, and remain alert to phishing referencing past Utair bookings, loyalty status, or accumulated miles.

Commercial airlines collect passenger identity, contact details, booking records, payment-adjacent information, itinerary data, loyalty accounts, and support interactions across travel operations.

Utair has continued to operate through the political and economic disruption that followed Russia's 2022 invasion of Ukraine, although Western sanctions have constrained access to international markets, aircraft parts, and certain digital services. Russian aviation more broadly has been the subject of a growing number of cybersecurity incidents linked to pro-Ukrainian hacktivist groups, including a major 2025 attack on flag carrier Aeroflot. Utair has not been publicly tied to a similar large-scale incident in the years since the 2019 leak. The 2019 dataset was added to public breach-tracking databases including Have I Been Pwned in late 2025.