“On July 25, 2024, we discovered a configuration error that may have inadvertently exposed your personal information in your FlightAware account, including user ID, password, and email address.”
FlightAware found the error on July 25 and emailed users more than three weeks later. The exposure covered passwords, billing addresses, phone numbers, year of birth, the last four card digits and aircraft owned. EU rules give companies 72 hours. A forced password reset does nothing for the address and phone number already out the door.