Imagine someone who started at Spirit Airlines in 1986. I'm sure there wasn't any email, no Teams, maybe a shared terminal somewhere in the office. I'd even bet money that the paperwork they signed on day one said nothing about computers, because there was nothing to say. Now, 40 years later, that person's employee records are part of a bankruptcy auction, packed in with 100 million emails and 500 million Microsoft Teams chats. And the winning bidder pays $10 million so the data can help train its AI models? Drumroll, please... Google.

Spirit Airlines Data For Sale

Spirit Airlines shut down in May after failing to emerge from its second bankruptcy. Now its assets are being sold — planes, gates, airport slots, and, it turns out, its data. According to an August 14 filing in the Southern District of New York, Google won the auction for part of Spirit's enterprise dataset and software code for $10 million, outbidding Mercor, an AI data company, at $7.5 million. The haul includes finance, operations, and revenue-management data; pricing models; roughly 3.4 million payroll records; about 30 million lines of code; and employee data dating back to 1986.

To be fair about what it doesn't include: customer data on Spirit's 97.5 million passengers and 52.4 million loyalty members is explicitly excluded. Spirit's investment banker states in a court filing that the data will be de-identified by a third party before transfer, and Google agrees not to attempt to re-identify anyone. Google's stated purpose is to improve its products and AI models. A judge is considering approving the sale this week. Those are the facts, and I'm not going to pretend otherwise — my issue isn't with how this buyer behaves. It's with what this sale reveals about the system.

What actually happened.

You signed away privacy to your employer, not to your employer’s estate sale.

If you've ever gone through security onboarding, you know the drill. It's a huge topic in the CISSP and AAISM material: employees sign an acknowledgment that they have no expectation of privacy on company systems: company equipment, company network, company data. There's usually a banner reminding you every time you log in.

That's understandable, and for good reason. The access exists for security, compliance, and investigations — the company is protecting itself on its own systems, and rightfully so.

But here's the thing. The acknowledgment says your employer can monitor your communications. Nobody's onboarding paperwork — not in 1986, probably not in 2006, not last year — said: "if this company goes bankrupt, your emails and chats may be auctioned to a third party as AI training data." That doctrine was built for an operational purpose, and bankruptcy just converted it into an asset class. And that's huge going forward, because I think we'll see more of this. AI needs data — we have to keep feeding it more and more — and companies are willing to pay serious money for consent given in one context, consumed in another context that didn't exist when it was given.

Is it legal? Apparently, the data is company property, and a bankruptcy estate exists to sell property — and honestly, that one line summarizes just how much data is worth now. But "legal" and "what anyone actually agreed to" are two different bars, and the gap between them is exactly where governance work lives. That's why I find this story so interesting.

I want to be careful here, because it would be easy to sound conspiratorial, and I'm not going to. I have no idea what Google will build with this, beyond what they've said.

But set the buyer aside and think about what this class of data teaches a model. Five hundred million workplace chats form a corpus of how organizations actually communicate — including what disengagement sounds like, what a team sounds like before people quit, and what an unhealthy project sounds like. In my first post, I wrote about Meta employees alleging that behavioral scoring systems were used in layoff decisions. That's this capability, deployed. My question isn't "what will this buyer do" — it's whether the 17,000 people who wrote those chats were ever part of a bargain that included any buyer learning from them. The data doesn't know what it's teaching. It's just data. It follows the paths it was given.

The capability question.

A few questions this story should prompt every security and governance team to ask:

Does your data governance treat communications as an asset class with a disposition plan — or do emails and chats accumulate forever until they're someone's line item? Retention policy isn't paperwork; in a bankruptcy, it's the difference between selling two years of chats and selling twenty.

Where does your trust boundary actually sit with vendors? Your contracts probably cover breach notification and uptime. Do any of them specify what happens to your data in the vendor's insolvency? The estate sale doesn't care what the marketing page promised.

And BYOD — if work messages sync to personal devices and personal accounts touch work systems, where does company data end? If your employer folds tomorrow, do you know which part of your digital life is in the estate?

We spend a lot of time in this field protecting data from attackers. This story reminds us that data has a second life we barely plan for: the one that starts when the organization holding it dies. The companies that handle that moment well are the ones treating data like a liability to be minimized and governed—not just an asset to be hoarded. Forty years of hoarded communications looked like storage costs, right up until it looked like $10 million.

Where’s your trust boundary?

Sources:

The sale described here was pending court approval at the time of writing. Facts are drawn from court filings and the reporting cited below; the opinions are my own, and nothing here is legal advice.