Austrian Airlines, Lufthansa, SWISS, Germanwings / Eurowings (com.lhgroup.lhgroupapp): Privacy & Security Findings

report - rfi-irfos
Skip to content

Permanent Disclosure Ledger

The discipline, demonstrated

On behalf of our research partners, we investigate publicly distributed Android and iOS apps: we decompile them, follow their code and data flows, and trace every connection to the servers it reaches. Hundreds of agents work through each app and join the technical evidence into one picture, which our specialists then review and verify.

387+
Android/iOS apps audited
Every app is decompiled at source-code level, not just scanned from outside.
1.04M+
Smali classes read
The full shipped code we have actually read, not an estimate.
262+
Critical findings recorded
Confirmed findings copied to regulators, not theoretical risks.
970+
Weak points found
Third-party tracking we have provably found inside the binary.
567+
Endpoints investigated
Real servers and countries where data actually flows.
132+
SDK instances mapped
Reusable libraries correlated across the entire corpus.
4 of 387 entries · sorted by elapsed ↓
Showing the report for Austrian Airlines, Lufthansa, SWISS, Germanwings / Eurowings.
OrganisationNotifiedStatusSevIntel (click to expand)StatutesResolvedDisclosureElapsedReport
Austrian Airlines
Private
2026-06-27
90d ago
Silent
High
Austrian Airlines shares one hidden technical platform, and one Firebase project, with Lufthansa, SWISS and Eurowings, meaning data about you can be consolidated across all four airlines without being disclosed. The app scans your passport and records your screen while you do it, and starts tracking before you have given consent, all while quietly requesting microphone access and reading your calendar.
LHGroup shared platform (com.lhgroup.lhgroupapp, 4771 classes) + Firebase project "groupappos" shared with Lufthansa/SWISS/Eurowings - cross-airline data consolidation undisclosed. Microblink BlinkID (348 classes): passport OCR scanner. Quantum Metric (582 classes): session recording active during passport scan. OneTrust CMP present (1081 classes) but bypassed by TealiumInitProvider + FirebaseInitProvider (both initOrder=100) pre-consent. RECORD_AUDIO undocumented. READ_CALENDAR + WRITE_CALENDAR. NEARBY_WIFI_DEVICES + CHANGE_WIFI_STATE. ACCESS_ADSERVICES_ATTRIBUTION + AD_ID. Firebase key AIzaSyDZX6LupHtN5MJRtYbaH47EHiAtDbLySZg hardcoded. DSB = lead authority (AT). Six messages sent across 78 days to datenschutz@/security@austrian.com; not one reply of any kind was ever received. Case closed and published 2026-09-25, on the stated embargo date. Sechs Nachrichten über 78 Tage an datenschutz@/security@austrian.com gesendet; es kam keine Antwort jeglicher Art. Fall geschlossen und veröffentlicht am 25.09.2026, am angekündigten Embargo-Datum. BCC: DSB + BfDI + CERT.at.
click to expand
GDPR Art. 9GDPR Art. 7
Yes
Closed
Disclosure
90d 00h 00m 00s
Published
PDF
Lufthansa
NYSE
2026-06-27
90d ago
Silent
High
Lufthansa runs the exact same underlying app as Austrian Airlines, carrying the same problems: it scans your passport and records your check-in session before you have consented, reads your calendar, and requests microphone access. It also jointly controls your data together with Austrian Airlines, SWISS and Eurowings without disclosing that shared arrangement to you.
LHGroup shared platform (com.lhgroup.lhgroupapp) - same binary as Austrian Airlines, same violations. Microblink BlinkID (passport OCR) + Quantum Metric session recording simultaneously active in booking/check-in flow. OneTrust CMP present but bypassed: FirebaseInitProvider + TealiumInitProvider (both initOrder=100) fire before consent. Two document scanning SDKs: Microblink + Scandit IdLibraryLoaderContentProvider. Firebase key AIzaSyBB10hYV3fiAqfWo8lIrm4ebYuIt3FCsT8 hardcoded, project groupapp-lh-prod. READ_CALENDAR + WRITE_CALENDAR + RECORD_AUDIO + ACCESS_ADSERVICES_ATTRIBUTION. LHGroup Art. 26 joint-controller relationship undisclosed across Lufthansa + Austrian + SWISS + Eurowings. BfDI = lead authority. Seven messages sent across 78 days to datenschutz@/security@lufthansa.com; not one reply of any kind was ever received. Case closed and published 2026-09-25, on the stated embargo date. Combined LHGroup platform report covering all four airlines: rfi-irfos.com/reports/lhgroup-2026-report.pdf. Sieben Nachrichten über 78 Tage an datenschutz@/security@lufthansa.com gesendet; es kam keine Antwort jeglicher Art. Fall geschlossen und veröffentlicht am 25.09.2026, am angekündigten Embargo-Datum. Kombinierter LHGroup-Plattformbericht über alle vier Fluggesellschaften: rfi-irfos.com/reports/lhgroup-2026-report.pdf. BCC: BfDI + DSB + CERT.at.
click to expand
GDPR Art. 9GDPR Art. 7GDPR Art. 26+1
Yes
Closed
Disclosure
90d 00h 00m 00s
Published
PDF
SWISS
Private
2026-06-27
90d ago
Silent
High
SWISS runs the exact same shared airline app used by Austrian Airlines and Lufthansa, scanning passengers' passports and recording their booking session before consent has been given. As a Swiss company operating in the EU, it also has no designated EU representative, and does not disclose that it jointly controls passenger data together with three other airlines.
LHGroup shared platform (com.lhgroup.lhgroupapp) - versionCode 1769525068 identical to Austrian Airlines and Lufthansa. Third R1 in coordinated LHGroup series. Microblink BlinkID (passport OCR, Art. 9) + Quantum Metric session recording active simultaneously in booking flow. OneTrust CMP bypassed: FirebaseInitProvider + TealiumInitProvider (both initOrder=100) fire before consent. Firebase key AIzaSyCq2VZOJyABzpmQLNOfm-bya3XyXmuCPUQ hardcoded, project groupapplx (IATA code LX). SWISS = CH company, no EU establishment → Art. 27 EU representative obligation. LHGroup Art. 26 joint-controller relationship across all four airlines undisclosed. Eight messages sent across 78 days to datenschutz@/security@swiss.com (datenschutz@ bounced); not one reply of any kind was ever received. Case closed and published 2026-09-25, on the stated embargo date. BCC: DSB + BfDI + CERT.at.
click to expand
GDPR Art. 9GDPR Art. 7GDPR Art. 27
Yes
Closed
Disclosure
90d 00h 00m 00s
Published
PDF
Germanwings / Eurowings
Private
2026-06-27
90d ago
Waiting
Critical
Eurowings collects usage data on every single app launch before its own consent tool has had a chance to run. It also requests permission to read your entire phone calendar, every personal and work appointment, when a permission limited to just writing a flight reminder would have been enough, and it does not disclose the payment processor handling your card details.
Eurowings GmbH / Lufthansa Group (com.germanwings.android v26.4.0, Cologne, DE). FirebaseInitProvider (ContentProvider, initOrder=100) fires before OneTrustInitializer (androidx.startup) - Firebase Analytics/Crashlytics collect before consent on every launch. READ_CALENDAR + WRITE_CALENDAR: WRITE alone suffices for flight reminders; READ grants access to full device calendar content (every personal + professional appointment) - Art. 5(1)(c) minimisation violation. Datatrans/Worldline CH (127 classes) payment processor not disclosed under Art. 13(1)(e). Qualtrics (221 classes) behavioral surveys. Approov API pinning (92 classes) = positive. RECEIVE_BOOT_COMPLETED. Google API key AIzaSyC0IcyXzcTHdYrPJKdfm1nLa30KoNP_kI0 hardcoded, project eurowings-2c53a. BfDI = lead authority. BCC: BfDI + CERT.at.
click to expand
GDPR Art. 7GDPR Art. 5(1)(c)GDPR Art. 13(1)(e)
Yes
Closed
Disclosure
90d 00h 00m 00s
Published
PDF

This ledger is updated in real time as companies respond. Silence is public. Severity is scored primarily by CVSS v4.0, we reserve the right to deviate based on blast radius.