BreachExchange mailing list archives
Passport data of 30 million Malindo and Lion Air customers leaked: here’s what we know
From: Destry Winant <destry () riskbasedsecurity com>
Date: Thu, 19 Sep 2019 09:23:16 -0500
https://www.businessinsider.sg/passport-data-of-30-million-malindo-and-lion-air-customers-leaked-heres-what-we-know/ A cybercrime Twitter channel detected on Sept 11 that the passport details of 30 million Lion Air passengers was available on the Dark Web. On Wednesday (Sept 18), Lion Group subsidiaries Malindo Airlines and Thai Lion Air admitted that customers’ data had been compromised. The leaked data was stored in a public cloud storage system created by Amazon Web Services, Malindo Air said. Both airlines said they did not store payment details on their servers. Two airlines have confirmed a leak of sensitive passenger data seven days after a cybercrime Twitter channel, named Under The Breach, detected it being shared and sold online. The channel found that two directories of backup files for Malindo Air, Thai Lion Air and Batik Air containing over 30 million records of passport details, addresses and phone numbers had been posted by a hacker on the Dark Web. All three are subsidiaries of Indonesia’s Lion Group. The information which was created in May, began circulating on multiple online forums as early as August 10, according to a report by Bleeping Computer, a cybercrime site. It added that file names included references to Lion Air’s loyalty reward program and online booking service GoQuo. On Wednesday (Sept 18), Thai Lion Air issued a statement on Facebook that it was aware of a data breach. It clarified that it had not stored customers’ payment details on servers, and promised to “increase preventative measures” to protect customers’ data better in the future. Malaysia’s Malindo Air also released a statement that had notified Malaysian and international authorities of the data breach. The leaked data was stored in a public cloud storage system created by Amazon Web Services, an external data service provider, Malindo Air said. It added that it was working with Amazon and GoQuo to investigate. The airline also assured customers that it did not store customers’ payment details on its servers, but advised those with frequent flyer accounts to change their passwords. The Straits Times reported that the airline declined to say how many customers had been affected by the breach. Batik Air did not release any statements about the data breach. _______________________________________________ BreachExchange mailing list sponsored by Risk Based Security BreachExchange () lists riskbasedsecurity com If you wish to Edit your membership or Unsubscribe you can do so at the following link: https://lists.riskbasedsecurity.com/listinfo/breachexchange
Current thread:
- Passport data of 30 million Malindo and Lion Air customers leaked: here’s what we know Destry Winant (Sep 19)