Cathay Pacific found in March this year that its IT systems had been breached and data of 9.4 million passengers stolen including names, birth dates, passport information, historical travel information, frequent flier numbers and small number of credit cards too.
The airline didn’t release information about this hack before Wednesday last week (read more here) and just begun emailing affected passengers (read more here). Hackers are already, however, in full mode sending out emails to passengers and trying to get them click on them that look like they had come from Cathay or from one of their partners.
You can access Cathay’s page for the hack information here.
Here’s an excerpt from SCMP (access their piece here):
“We are aware that attempted phishing is taking place, and would like to remind people that emails related to this data security event will only be sent from firstname.lastname@example.org,” the airline wrote on its website.
Passengers should not click on variations of links to data monitoring services, it added.
“The number of users affected are quite a lot in this breach, and there could be phishing emails or calls purporting to represent the company,” said Wilson Wong Ka-wai, the head of Hong Kong Computer Emergency Response Team Coordination Centre at the Productivity Council.
“The CX case may well result in ‘spear phishing,’ where stolen details are used to customise phishing emails, to make them far more target-specific and believable,” Gazeley said, adding that once personal information hits the dark web it can then be aggregated with other existing leaked data belonging to victims.
These airlines hacks are a total mess and the scale of this Cathay Pacific one is massive considering all the data that was stolen.
You could construct very believable email with all the information that these thieves now have and send them to an unsuspecting frequent flier program member offering “credit monitoring services”.
I don’t think that these hacks will end before there is a financial penalty high enough set by the governments that would make these companies to invest enough to their IT systems to ensure that these unfortunate events wouldn’t take place.