Now departing: your airline customer data.
Malaysia Airlines faces the daunting task of investigating over nine years鈥� worth of compromised data after learning of a 鈥渄ata security incident鈥� at a third-party IT service provider that exposed Enrich frequent flyer program member data from March 2010 through June 2019.
Airline loyalty program data is a popular target among cybercriminals. And a breach that lingers undetected for nearly a decade would have granted any potential attackers plenty of time to leverage such information to commit a host of scams and phishing schemes and to steal and sell victims鈥� flyer miles. However, Malaysia Airlines claims that so far there is no evidence of data misuse.
鈥淎irlines are a rich source of information, with a big supply of passenger name records that are used to share information between booking systems, global distribution systems and hotels,鈥� said Andrew Barratt, managing principal of solutions and investigations at Coalfire. 鈥淎irlines in general are a high-profile target, with loyalty data that can be easily monetized.鈥� Payment information can also be compromised, as was seen in the .
In this particular instance, the compromised data includes name, contact information, date of birth, gender, frequent flyer number, membership status, and rewards tier level. Malaysia Airlines鈥� own internal IT infrastructure was not impacted. Travel details, payment info and passwords were not compromised, although customers are still advised to change their login credentials.
鈥淥n the surface, this data seems less likely to cause damage to the consumer. However, this stolen data forms a part of the consumers profile that is created by data stolen from many locations,鈥� said Purandar Das, CEO and co-founder of Sotero. 鈥淚n totality, this enables the hackers to assemble a strong profile of the consumers and their behavior and could be used to target them for nefarious purposes.鈥�
So far, details around the breach are scant, and SC Media so far did not receive a response to a request for comment from Malaysia Airlines. But the fact that data corresponds to near years of customers is certainly troubling, experts say.
鈥淭he fact that this breach happened over a long period of time without detection indicates the lack of security at the service provider,鈥� Das said. 鈥淚t is also unlikely that this data was not used for wrong reasons if the breach lasted as long it did. If the data was useless, the hackers would have moved on.鈥�
According to at least , the airliner yesterday began emailing its customers breach notifications. Of course, after nine years, it鈥檚 possible some ex-members have changed their emails and other contact information. The company will not attempt to contact victims by phone, so any calls customers receive related to this incident should be considered a scam.
鈥淭his incident highlights the need for strict rules around time to disclose,鈥� particularly for third-party vendors, said Brandon Hoffman, chief information security officer at Netenrich. 鈥淚n a similar scenario, had more detailed personal information or financial information been stolen, the impact could be very widespread if it took place nine years ago.鈥�
Indeed, this latest incident is another example of why it鈥檚 important for businesses to assess and manage third-party vendor risk.
鈥淥rganizations continue to be impacted by under-protected third-party service providers,鈥� said Das. 鈥淲hile such services are a key part of an organization鈥檚 customer services, they pose an increasing risk to the company. This is an area that is being targeted by hackers. Service providers are less organized in terms of security. Their infrastructure is less secure and more easily penetrated.鈥�
鈥淥ne of the challenges with using third-party systems is the potential difficulty of holding them to the same level of cybersecurity used in your own organization,鈥� added Saryu Nayyar, CEO at Gurucul. 鈥淵ou could have a complete security stack, security analytics and a trained security operations team, but that may not help when a trusted third party isn鈥檛 operating at the same standard.鈥�
SOURCE: Bradley Barth/
