The weakness is a check-in link that is emailed to customers, and it exposes information such as passport numbers, flight numbers, researchers at Wandera said. The affected airlines include Southwest, Air France and KLM.

The same group may have been behind the ticketmaster breach in the UK.