Cathay Pacific data breach hits 9.4 million customers

Airline says credit card details, passport numbers and physical addresses were part of the stolen trove of data

Chinese airline Cathay Pacific has admitted to being victim to a massive data breach, thought to have resulted in the loss of information belonging to as many as 9.4 million passengers.

The airline has said data stolen includes names of passengers, their nationalities, dates of birth, telephone numbers, email and physical addresses, passport numbers, identity card numbers, historical travel information, and credit card numbers.

Advertisement - Article continues below

Suspicious activity was first discovered in March, and the airline said that it has taken immediate action to investigate and contain the event, but stressed that it had no evidence that any personal information has been misused.

Around 9.4 million passengers of Cathay and its unit Hong Kong Dragon Airlines Limited had been accessed without authorisation. This included 860,000 passport numbers, about 245,000 Hong Kong identity card numbers, 403 expired credit card numbers and 27 credit card numbers with no card verification value (CVV).

"We are very sorry for any concern this data security event may cause our passengers," CEO Rupert Hogg said in a statement. He added that the airline is in the process of contacting affected people.

"We have no evidence that any personal data has been misused. No-one's travel or loyalty profile was accessed in full, and no passwords were compromised," he added.

Advertisement
Advertisement - Article continues below

Cathay Pacific said it had notified the Hong Kong Police and is also "notifying the relevant authorities".

Advertisement - Article continues below

Randy Abrams, senior security analyst at Webroot, told IT Pro that airlines appear to be an increasingly popular target for cybercriminals. In recent months, Air Canada and British Airways have both suffered breaches. Although the company is based in Hong Kong, it's dealings with European customers place it in the firing line for GDPR enforcement.

"The Cathay Pacific breach disclosed a feature-rich set of data, including more than 40 times more passports than the Air Canada breach, meaning it will have a much greater impact on passengers," he said.

"In addition to the reputation cost, Cathay Pacific may face costly GDPR repercussions due to the amount of time that passed between the discovery of the breach and reporting it to the public."

Ed Macnair, CEO of CensorNet, told IT Pro that what is concerning with this breach is the fact that the issue was first identified in March and confirmed in May, and yet Cathay Pacific is only now making it public.

Advertisement - Article continues below

"Given that the data stolen included passport details, travel itineraries and some payments information even if only for a small number of people the airline should have immediately informed those affected, allowing them to act quickly. While it might seem disparate, hackers can use a combination of the data stolen to build up a picture of someone, which can lead to identity theft and other serious problems for individuals," he said.

Featured Resources

Top 5 challenges of migrating applications to the cloud

Explore how VMware Cloud on AWS helps to address common cloud migration challenges

Download now

3 reasons why now is the time to rethink your network

Changing requirements call for new solutions

Download now

All-flash buyer’s guide

Tips for evaluating Solid-State Arrays

Download now

Enabling enterprise machine and deep learning with intelligent storage

The power of AI can only be realised through efficient and performant delivery of data

Download now
Advertisement

Recommended

Visit/security/vulnerability/355236/hp-support-assistant-flaws-leave-windows-devices-open-to-attack
vulnerability

HP Support Assistant flaws leave Windows devices open to attack

6 Apr 2020
Visit/security/cyber-security/355234/safari-bug-let-hackers-access-cameras-on-iphones-and-macs
cyber security

Safari bug let hackers access cameras on iPhones and Macs

6 Apr 2020
Visit/software/video-conferencing/355229/zoom-we-moved-too-fast
video conferencing

Zoom CEO admits company "moved too fast" as privacy issues mount

6 Apr 2020
Visit/security/internet-security/355228/mozilla-fixes-two-firefox-zero-days-being-actively-exploited
internet security

Mozilla fixes two Firefox zero-days being actively exploited

6 Apr 2020

Most Popular

Visit/mobile/mobile-phones/355239/microsofts-patent-design-reveals-a-mobile-device-with-a-third-screen
Mobile Phones

Microsoft patents a mobile device with a third screen

6 Apr 2020
Visit/development/application-programming-interface-api/355192/apple-buys-dark-sky-weather-app-and-leaves
application programming interface (API)

Apple buys Dark Sky weather app and leaves Android users in the cold

1 Apr 2020
Visit/software/video-conferencing/355229/zoom-we-moved-too-fast
video conferencing

Zoom CEO admits company "moved too fast" as privacy issues mount

6 Apr 2020