"At this point, even though only a small subset of our customers would have been exposed, we cannot say definitively whether any of our customers' information was actually accessed or subsequently compromised," the company said.
The attack was limited to a period between September 26 and October 12 and targeted clients of Delta and other firms that used the [24]7.ai online chat. The airline said no other personal data, such as passports, IDs, security or frequent flier information, was impacted.
The chat service made the data breach known on March 28, Delta said, adding it had immediately engaged federal law enforcement and forensic teams. The airline will launch a dedicated website on Thursday to update its customers on the probe.