matthewgwinn.com

For Sale in Spirit’s Bankruptcy: Its Employees’ Emails and Records

AI Watch banner: glowing neural-network brain and data stream

Spirit Airlines’ bankruptcy is about to decide whether a company’s internal email and chat can be sold, on their own, to an AI developer. The law’s privacy safeguard was built for customers. Most of what’s for sale came from workers.

By the Editorial Engine staff · Facts current as of October 17, 2026

Spirit Airlines stopped flying in May 2026. By August it was liquidating in a federal bankruptcy court in White Plains, N.Y., and one of the assets up for sale had never carried a passenger. It was the company’s memory: roughly 100 million emails from about 80,000 accounts, 500 million items from Microsoft Teams, about 38 million OneDrive and SharePoint items, 175,658 employee records reaching back to August 1986, payroll and tax forms since 2016, 516 software repositories, and the pricing and operations data that ran the airline.

On August 14, Google won it at auction for $10 million, according to the notice of auction results Spirit filed that night. The backup bidder was Mercor, a company that supplies training data to AI labs. A third AI-data firm, micro1, later filed notice that it wanted to offer $12.5 million. Google’s lawyers told the court’s privacy ombudsman that the data “will be used for the training of artificial intelligence (AI) models,” according to her September 8 report.

Much of the coverage since has said Spirit sold its data to Google. It hasn’t yet. The judge has not approved the sale, nothing has been delivered, and the hearing has been pushed back repeatedly. It is now set for 11 a.m. on November 6. And what Google bid on is mostly not passenger data. Spirit’s 97.5 million customer profiles and 50.2 million Free Spirit loyalty members were marked “Not Included” from the start. What is included is, overwhelmingly, the record of the people who worked there.

That is the more interesting story, and the reason the case matters well beyond one dead airline. American bankruptcy law has exactly one mechanism for weighing privacy when a failing company sells data, and it was written for customers. The asset AI developers increasingly want from dead companies is the ordinary written work of employees. The Electronic Privacy Information Center (EPIC), a privacy advocacy group, told the court that, to its knowledge, no employer had ever tried to sell its employees’ data as an asset in bankruptcy before. The judge will rule on the unions’ objections, but no court officer is charged with weighing what the sale means for the workers.

What is actually in the box

The asset list attached to the auction notice is unusually specific. Alongside the email and chat archives it lists 148,018 tax forms, about 1.09 million timecards, training and crew records, legal files and contracts, and booking-curve and fare data. It also originally listed several datasets that touched passengers, including reservation records, refunds, and inflight and Wi-Fi sales, in scrubbed form.

Chart listing Spirit Airlines datasets from the August 2026 asset schedule, laid out in three columns: Not included on the left, Included in the middle, and Included (continued) on the right, above a band of later carve-outs reported by unions. Not included: 97.5 million customer profiles, 50.2 million Free Spirit members, 44 million earned miles, 13.7 million email addresses, 30.9 million call recordings, 15.8 million chat sessions, website analytics and DOT complaint data. Included: 100 million emails from 80,000 accounts, 500 million Teams items, about 37.7 million SharePoint and OneDrive items, 175,658 employee records from 1986, 3.4 million payroll records, 148,018 employee tax forms, 516 code repositories, fare and pricing observations, operations and maintenance records, and finance and legal files. Marked tentative as later exclusions: PNRs, revenue transactions, refunds, on-board purchases, Wi-Fi sales and time cards, plus union-reported carve-outs of medical, drug-testing, leave, accommodation, union, grievance and Labor Relations records. Flight attendants' tax forms are shown as still included.
Figure 1. What Spirit put up for sale. The asset schedule attached to the August 14 auction notice marks the customer and loyalty databases “Not Included” and the email, chat, employee, code, revenue and operations data “Included.” Datasets later dropped, according to Google’s September 9 filing and union filings, are marked tentative: no revised schedule has been filed with the court, and flight attendants’ tax forms remain in, subject only to deidentification.
Source: In re Spirit Aviation Holdings, Bankr. S.D.N.Y. No. 25-11897, ECF 1463, Exh. A, Pg 18; ECF 1594 ¶4; ECF 1656 ¶¶1, 5, 10; ECF 1658 ¶7; ECF 1684, Pg 5 n.8. Chart: Editorial Engine.

Those passenger-adjacent sets have since been dropped. Google’s September 9 response to the ombudsman lists them as excluded, along with timecard information, and says the deal “is not, and never has been, a sale of Consumer Data.” Unions say the debtors have also agreed to carve out medical and disability files, drug and alcohol testing records, leave records, and labor-relations email. None of this is binding yet. No revised asset schedule has been filed with the court, and the ombudsman described the one she saw as a draft “still subject to change.” Some things remain in. The flight attendants’ union wrote on September 24 that “Google has not agreed to exclude flight attendant tax forms, which remain subject only to deidentification.”

Deidentification is the central promise. Before anything changes hands, an outside firm, Tonic.ai, is supposed to scrub the data so that, in the contract’s words, it cannot be “linked to, a particular consumer.” The contract has the scrubbing certified “to Buyer’s reasonable satisfaction,” not to the court. Filing that certification with the court is something the debtors have proposed, according to the ombudsman’s report, and the proposed sale order does not mention employees at all. Google, through a spokesperson, has made a similar promise publicly. Axios quoted the company as saying: “We acquired part of an enterprise dataset from Spirit Airlines, which can be helpful in improving our products and AI models,” and “Any data we receive will be rigorously scrubbed of any personally identifiable information by a third party before receipt.” (The Miami Herald printed the same statement beginning “We’re acquiring.” Either way, the sale has not closed.)

Spirit, for its part, kept the right to sell its customer list separately, to buyers “in hospitality or travel industries.” The ombudsman wrote that a later auction for the 97.5 million passenger records is planned. If your concern is your own frequent-flyer history, that is the sale to watch.

Why an AI developer wants a dead airline’s email

A $10 million bid for old corporate correspondence would have looked strange a few years ago. Two shifts explain it.

The first is supply. The public web, the raw material for today’s large language models, is finite. Epoch AI, a research group that tracks the field, estimates the stock of usable public text at roughly 300 trillion tokens and projects that models will have trained on all of it sometime between 2026 and 2032. Private text is the obvious frontier, though Epoch itself was skeptical it could be tapped. “Non-public data, like instant messages, seems unlikely to be used at scale due to legal issues,” its authors wrote.

The second is what labs are now trying to teach. The industry’s current push is toward AI “agents” that carry out multistep office work: triaging a ticket queue, reconciling a schedule, drafting the email that follows a meeting. Training them benefits from examples of how real organizations actually do that work, with the dead ends and handoffs that public text rarely captures. Buyers use such archives to build simulated workplaces, sometimes called reinforcement-learning “gyms,” where an agent can practice. The Spirit bidding shows who sees value in this. Google and Mercor, the two named qualified bidders, are an AI developer and an AI-data supplier, and micro1, which came in after the auction, is another AI-data supplier. Court filings do not identify the third bidder that qualified for the auction.

Bar chart of bids for Spirit's data. At the August 14 auction: Google opening bid $5 million; Mercor first overbid $5.2 million, or $7 million conditional on doing its own deidentification; Google winning bid $10 million; Mercor backup bid $7.5 million; Mercor $10 million offer conditional on in-house deidentification, not chosen. After the auction: micro1 notice of intent to bid $12.5 million, not accepted. Conditional bids are drawn with dashed, hatched outlines and the post-auction notice with a dotted outline.
Figure 2. How the bidding went. Google opened at $5 million and won at $10 million; Mercor’s $7.5 million bid became the backup. Mercor’s $10 million offer, like an earlier $7 million one, depended on Mercor doing the deidentification itself instead of a third party, and the debtors did not choose it. micro1’s $12.5 million came after the auction, as a notice of intent to bid, and has not been accepted.
Source: In re Spirit Aviation Holdings, Bankr. S.D.N.Y. No. 25-11897, ECF 1463, Pg 2; ECF 1470 (Friesner Decl.) ¶¶10–15; ECF 1556 ¶¶1, 4. Chart: Editorial Engine.

It is fair to ask whether the material is worth what’s being paid. MIT Technology Review reported this month that “no company has yet released tests comparing results of real-world data training with the alternatives,” and that buyers’ valuations vary widely. The price is a bet, not a measurement.

The market below the courtroom

Spirit is the first big, public instance, but the practice did not start there. In April, Forbes reported on companies that help startups shut down and have begun selling what the startups leave behind. One, SimpleClosure, launched a marketplace for source code and workspace data (email, Slack, Notion, shared drives) the same month. Another, Sunset, advertises help for founders who want to “monetize their data with AI labs.”

The best-documented sale involves cielo24, a captioning and transcription company that has since wound down. Its chief executive, Shanna Johnson, told Forbes the company received “hundreds of thousands of dollars,” which she said took her from “I don’t know how we are going to pay our bills” to “we can tie this up neatly with a bow and be able to walk away.” SimpleClosure’s own account of the deal says the buyer was “an organization working at the forefront of language technology.” It does not name it. A founder named Keelan Miskell told MIT Technology Review he had netted about $25,000 for his crypto startup’s code and expected roughly $15,000 more for its Google, Notion, Figma and Slack data.

Beyond those cases, the size of this market rests on one source. SimpleClosure’s chief executive, Dori Yona, told Forbes in April that the company had done nearly 100 deals in the past year, typically paying $10,000 to $100,000 per company. By October, MIT Technology Review reported, the count was more than 150. The company’s own press release describes its volume differently, and no one outside the firm has audited any of these figures. What is clear is the structure. Buyers are rarely named, and “founders have little to no visibility into who is buying the data and what they plan to do with it,” as MIT Technology Review put it.

SimpleClosure and Sunset describe their business in terms of dissolutions and structured wind-downs, not bankruptcy cases. To the extent these sales happen outside bankruptcy, none of the safeguards in Spirit’s case apply to them. No bankruptcy judge reviews them, and no ombudsman is appointed.

A safeguard built for customers

The safeguard Spirit’s case does have dates to a dot-com flameout. In 2000, the Federal Trade Commission sued Toysmart.com, a bankrupt online toy seller, to stop it from auctioning a customer list it had promised would never be shared. The FTC settled on terms that would have allowed a sale only to a buyer in a related market who honored the old promise. One dissenting commissioner, Orson Swindle, would have gone further: “‘never’ really means never.” The court never approved that deal. In early 2001 the list was destroyed instead, with a Disney affiliate paying $50,000 to make that happen.

Congress wrote the lesson into the Bankruptcy Code in 2005. Under Section 363(b)(1), if a company’s privacy policy barred transferring personal information, the company can’t sell that information in bankruptcy unless the sale fits the policy or a court approves it after hearing from a “consumer privacy ombudsman” (Section 332). The key limitation is in the definition. “Personally identifiable information,” for these purposes, means information provided “in connection with obtaining a product or a service from the debtor primarily for personal, family, or household purposes.” That is customer data. A worker’s payroll file, performance review or Teams thread was never provided to obtain a product, so it is outside the definition.

Even for customers, the system has produced conditions rather than prohibitions. When RadioShack went bankrupt in 2015, the FTC’s consumer-protection director warned that selling data on about 117 million customers could be deceptive. The eventual sale was cut down to a narrower set of recent records, with an opt-out window. In the 2025 bankruptcy of the genetic-testing company 23andMe, more than 30 states objected and FTC Chairman Andrew Ferguson wrote that the company’s privacy promises “must be kept.” The court approved the $305 million sale to a nonprofit led by the company’s co-founder anyway, and declined to require customers’ opt-in consent. A 2023 Hastings Law Journal article called the whole regime “privacy theater.”

Timeline from 2000 to 2026. 2000 to 2001, Toysmart: the FTC settlement would have allowed a sale only with the whole site to a buyer bound by the privacy promise; the court never approved it and the list was destroyed for $50,000 in January 2001. 2005: Congress adds a privacy-policy limit on selling customer personal information and creates the consumer privacy ombudsman, covering customers only. 2015, RadioShack: the FTC warns about data on about 117 million customers and the court approves a narrowed sale. 2025, 23andMe: a $305 million sale to the co-founder's nonprofit is approved without requiring customers' opt-in consent. A 2026 panel shows Spirit stopping flights on May 2, the August 14 auction won by Google at $10 million, and the sale hearing set for November 6 at 11 a.m., still pending.
Figure 3. Twenty-six years of bankruptcy data sales. Each earlier episode turned on customer records, and the 2005 law that governs such sales protects information customers provided. Spirit’s sale, mostly of workers’ records, awaits a hearing set for 11 a.m. on November 6, 2026.
Sources: FTC press release, July 21, 2000; Computerworld, Jan. 30, 2001; 11 U.S.C. §332 and statutory note (Pub. L. 109-8); FTC letter re RadioShack, May 16, 2015; Alston & Bird, June 3, 2015; In re 23andMe, Mem. Op. (Bankr. E.D. Mo. June 27, 2025); Spirit release, May 2, 2026; ECF 1463; ECF 1695. Chart: Editorial Engine.

Spirit adds a further wrinkle. Outside bankruptcy, the FTC’s usual tool against broken privacy promises is its power over unfair and deceptive practices. But the FTC Act exempts air carriers, which fall to the Department of Transportation. The FTC also has a broader warning on the books. Its staff wrote in 2024 that it “may be unfair or deceptive” for a company to start “using that data for AI training” while disclosing the change only through a quiet rewrite of its terms. But that warning, too, was about consumers.

The people in the data

The ombudsman, Lucy L. Thomson, was appointed in July. Her review did reach the email and Teams archives, but only to look for passengers in them. Her October 5 supplemental report recommends that “from a privacy perspective, approval of the sale of the deidentified data would be appropriate.” A footnote marks the limit of that judgment: “The Ombudsman did not investigate or reach any conclusion about whether the data offered for sale or the deidentification process to be followed presents any risks to affected employees or third parties.”

That footnote is accurate to her mandate. It also describes the gap. The Association of Flight Attendants put it in one line: “The privacy architecture of this transaction is consumer-facing; its payload is disproportionately employee-facing.” In a later filing the union wrote that “no comparable officer examines this transaction for the employees whose records it principally conveys.”

The workers are not wholly unprotected, and the objection list shows where their leverage comes from. The flight attendants, the Air Line Pilots Association (ALPA), and the Allied Pilots Association have objected, citing collective-bargaining agreements, confidentiality, and, for the pilots, the voluntary safety-reporting programs that depend on trust. The Machinists and the Transport Workers joined the flight attendants’ objection. “Inasmuch as the data will likely become accessible to the public through available large language model artificial intelligence programs, confidentiality of pilot data will almost certainly be compromised to the detriment of flight safety,” ALPA wrote. Vendors have objected too, among them Springshot, a software company that says its material ended up in the archive, and International Aero Engines and Navitaire, which cite confidentiality agreements. California’s privacy law has covered employees since 2023, and the deidentification in the deal is pegged to its standard. But that law protects only California residents, the contract applies its standard only “to the extent applicable to U.S. consumers,” and EPIC argues the deal’s deidentification guarantee “does not clearly extend to employee data.” In October, 121 members of Congress, led by Representative Steven Horsford and Senator Elizabeth Warren, wrote to Google and Spirit that “this sale presents uncharted territory.” EPIC and a law professor asked to file a brief, saying in their motion that “to amici’s knowledge, no employer has attempted to sell its employees’ data as an asset in bankruptcy prior to the instant case.”

What that patchwork lacks is a rule written for the situation and a person charged with applying it. Protection depends on whether workers happen to have a union, a contract clause, or a vendor whose lawyers are paying attention. The non-union staff of a startup sold off in a private wind-down have none of these.

Then there is the question of what deidentification protects. Here the contract matters more than speculation about hackers. The sale terms measure anonymity against “a particular consumer.” They require the data to keep its “referential integrity,” so that records stay linked across systems. And the buyer’s promise covers only intentional attempts to re-identify people. The flight attendants’ union is careful not to claim that any specific record can be traced back to a person. Its argument is different: “Deidentification addresses whether a record can be traced to a named individual. It does not address whether the contents of the record are confidential.” A complaint to human resources, a medical leave discussed over chat, or a dispute with a supervisor stays sensitive with the name removed, especially in a workforce small enough that colleagues can recognize each other.

Re-identification is a plausible risk, not a demonstrated one. Researchers have shown that “anonymous” structured records can often be matched back to people. One 2019 study estimated that 99.98 percent of Americans could be correctly re-identified from 15 demographic attributes. Others have shown that language models can reproduce passages that appeared in just one document in their training data. We found no published study that has tested re-identification in scrubbed corporate email at this scale, which is part of the problem. The ombudsman, for her part, wrote that “[w]hile properly deidentified data has a very low risk of re-identification, combining it with external datasets or using insufficient deidentification methods can potentially reveal individual identities.” She made that judgment about passengers, not employees. The question is being settled by a sale contract rather than by evidence.

What November 6 decides

Judge Sean H. Lane has several options. He can approve the sale as proposed. The only proposed sale order on file, from August 17, contains no employee protections. He can approve it with conditions, such as binding the exclusions the unions say they have negotiated, restricting what Google may pass to third parties (the current terms allow onward transfer to anyone who accepts the same no-reidentification terms), or adding oversight of the deidentification itself. Or he can reopen the bidding, where micro1 is offering more money along with employee-specific promises. The objections could also fall away before then. The Miami Herald, citing a person familiar with the process, reported that Spirit hopes to win the unions’ support by November 6. The ruling may come as soon as the hearing, so parts of this account could be out of date within weeks.

Whatever he decides, the case has already shown something the market for dead companies’ data had kept out of view. That market had been trading workers’ records quietly, in deals too small to notice, with buyers no one named. Spirit put one such sale on a public docket, with a price, a buyer and a stated purpose. It also showed that the law’s privacy machinery, asked to examine a corpus written mostly by employees, was built only to examine it for customers. The next sale is more likely to be smaller, private and unreviewed. Whether employees get a seat at those tables will depend on whether courts, legislators or contracts give them one. So far, the people whose work makes up the asset have had to win their place in this courtroom one objection at a time.

Source notes

Court filings are from In re Spirit Aviation Holdings, Inc., No. 25-11897 (SHL) (Bankr. S.D.N.Y.), before Judge Sean H. Lane in White Plains, N.Y., and are cited by docket (ECF) number. Links were checked October 17, 2026; some government and news sites block automated checkers but open in a browser.

Spirit bankruptcy filings

Other courts, statutes and government documents

Company statements

Reporting and research