Cathay Pacific airline hit by massive data breach that exposed 9.4 million passengers’ data

• Passengers’ names, nationality, dates of birth, phone numbers, passport numbers and more may have been stolen.
• The breach occurred in March 2018 and involved hackers stealing customers’ financial information.

Hong Kong-based airline Cathay Pacific has confirmed that it suffered a data breach that has compromised 9.4 million passengers’ data.

The firm believes that passengers' personal details including names, nationality, dates of birth, phone numbers, email addresses, passport numbers, identity card numbers, frequent flyer membership numbers, custom service remarks and travel history might have been stolen by hackers.

Discovery of breach

The company disclosed that it discovered some suspicious activities on its network in March 2018, following which it took immediate action to contain the breach. However, it was in early May, when the company discovered that hackers had gained unauthorized access to sensitive data.

“Unauthorized access to certain personal data was confirmed in early May 2018. Since that time, analysis of the data has continued in order to identify affected individuals and to determine whether the data at issue could be reconstructed,” said the airline's officials in a statement.

Expired credit cards stolen

Cathay Pacific said that the stolen information included around 860,000 passport numbers and approximately 245,000 identity card numbers. A total of 403 expired credit card numbers were also accessed by the hackers, of which 27 cards had no CVV numbers.

“The information accessed varies between passengers. No travel or loyalty profiles were accessed in full. No passwords were compromised. Approximately 860,000 passport numbers and approximately 245,000 Hong Kong identity card numbers were accessed,” the firm said.

The airline said that it has begun notifying the affected passengers via email and phone. The firm is advising its customers change the passwords of their accounts as a precautionary measure, although no passwords were compromised in the breach.

“Where possible, we are offering ID monitoring services to affected passengers. This service monitors if your personal data may be available on public websites, chat rooms, blogs, and non-public places on the internet where data can be compromised such as dark websites,” the company added, in its statement.