EasyJet PLC (LON:EZJ) has been the victim of a hacking attack that revealed personal details of nine million customers.
Email addresses and travel details accounted for the majority of the data breach, but 2,208 customers also had credit card details accessed, said the airline.
The carrier said it was not aware of any misuse of the information and it has closed the channels affected by the attack, though there were no details on when and for how long it occurred.
In a statement, the Luton-based group said: "We're sorry that this has happened, and we would like to reassure customers that we take the safety and security of their information very seriously.
"EasyJet is in the process of contacting the relevant customers directly and affected customers will be notified no later than 26th of May."
The hack comes at a difficult time for the airline, which has grounded most of its fleet due to coronavirus-related travel restrictions.
Founder and majority shareholder Stelios Haji-Ioannou, meanwhile, is waging a bitter campaign against an order of new planes from Airbus.
He is proposing a board overhaul to get his way and has offered a bounty to whistleblowers for ‘useful information’ to help get the £4.5bn order cancelled.
The airline now also faces a hefty fine under data protection rules If it is found to be at fault for the breach,
Rival British Airways was penalised £183mln for a data breach in 2018 that revealed details of 500,000 customers.
EasyJet chief executive Johan Lundgren said: "We take the cybersecurity of our systems very seriously and have robust security measures in place to protect our customers' personal information. However, this is an evolving threat as cyber attackers get ever more sophisticated.
"Since we became aware of the incident, it has become clear that owing to COVID-19 there is heightened concern about personal data being used for online scams.
"As a result, and on the recommendation of the ICO, we are contacting those customers whose travel information was accessed and we are advising them to be extra vigilant, particularly if they receive unsolicited communications."
Shares rose slightly to 555.2p.