In notification letters sent out on September 16, the airline said it discovered the data breach on July 5.
Data potentially stolen by attackers included employees’ and customers’ names, birthdates, addresses, phone numbers and identification card numbers.