Cathay Pacific flags data breach affecting 9.4 million passengers

guest · Oct 24, 2018

Cathay Pacific flags data breach affecting 9.4 million passengers
October 24, 2018
https://www.reuters.com/article/us-...affecting-94-million-passengers-idUSKCN1MY26L

Cathay Pacific Airways Ltd said on Wednesday that data of about 9.4 million passengers of Cathay and its unit Hong Kong Dragon Airlines Limited had been accessed without authorization.

Cathay said 860,000 passport numbers, about 245,000 Hong Kong identity card numbers, 403 expired credit card numbers and 27 credit card numbers with no card verification value (CVV) were accessed in the breach.

Hogg said no passwords were compromised in the breach and the company was contacting affected passengers to give them information on how to protect themselves.

The company said it initially discovered suspicious activity on its network in March 2018 and investigations in early May confirmed that certain personal data had been accessed.
Click to expand...

EASTER · Oct 25, 2018

Hong Kong privacy chief slams Cathay Pacific for taking months to notify passengers about massive data breach
Thursday, 25 October, 2018
https://www.scmp.com/news/hong-kong...ong-privacy-chief-slams-cathay-pacific-taking

Privacy Commissioner Stephen Wong says authorities are considering changing rules to require such leaks to be reported promptly Airline says reason for delay was to avoid causing unnecessary panic among customers
Click to expand...

guest · Oct 31, 2018

UK Law Firm Preps Cathay Pacific Class Action
October 31, 2018
https://www.infosecurity-magazine.com/news/uk-law-firm-preps-cathay-pacific/

UK lawyers are preparing a class action suit against Cathay Pacific, claiming that the firm is liable for compensation “under the relevant data protection laws.”

SPG Law, which claims to draw on some of America’s top class action lawyers, has already registered the cathaydatabreach.com domain and is inviting those affected to get in touch.

“The breach is even more serious than that committed by BA in September 2018 in that Cathay Pacific customers like you have suffered from far more substantial personal data being leaked,” a statement on the site noted.
Click to expand...

guest · Nov 12, 2018

Cathay Pacific hack: Airline admits techies fought off cyber-siege for months
November 12, 2018
https://www.theregister.co.uk/2018/11/12/cathay_pacific_hack_data_siege_3_months/

In a submission made by the airline to Hong Kong’s Legco (its Legislative Council; broadly, the semi-autonomous Chinese territory’s equivalent of Parliament) reveals (PDF, 4 pages), ahead of a Wednesday hearing, Cathay said it knew that in March the “suspicious activity” was a full-scale attack on its servers.

“During this phase of the investigation, Cathay was subject to further attacks which were at their most intense in March, April and May but continued thereafter. These ongoing attacks meant that internal and external IT security resources had to remain focused on containment and prevention,” said the airline in its written submission to local legislators.

As an explanation for the delay in telling anyone about the hack, Cathay said it “wanted to be able to give a single, accurate and meaningful notification to each affected passenger, rather than to provide an overly broad and non-specific notice.”
Click to expand...

Written Submission by Cathay Pacific Airways Unlimited - Joint Meeting, 14 November 2018 (PDF): https://www.legco.gov.hk/yr18-19/english/panels/ca/papers/caitbse20181114cb2-222-2-e.pdf

guest · Jun 6, 2019

mood said: ↑

Cathay Pacific flags data breach affecting 9.4 million passengers
Click to expand...

Media Statement (June 6, 2019)

The Privacy Commissioner for Personal Data, Hong Kong (Privacy Commissioner) Mr Stephen Kai-yi WONG today published an investigation report on the data breach incident of unauthorised access to personal data of approximately 9.4 million passengers of Cathay Pacific Airways Limited and Hong Kong Dragon Airlines Limited (collectively referred to as Cathay).
Data Security
Cathay did not take all reasonably practicable steps to protect the affected passengers’ personal data against unauthorised access in terms of vulnerability management, adoption of effective technical security measures and data governance [...]

"[...] It is quite clear that contraventions aside, Cathay adopted a lax attitude towards data governance, which fell short of the expectation of its affected passengers and the regulator.”
Click to expand...

Investigative Report (PDF - 847 KB): https://www.pcpd.org.hk/english/news_events/media_statements/files/PCPD_Investigation_Report_R19_15281_E.pdf

guest · Mar 4, 2020

International airline fined £500,000 for failing to secure its customers’ personal data
March 4, 2020
https://ico.org.uk/about-the-ico/ne...ailing-to-secure-its-customers-personal-data/

The Information Commissioner’s Office (ICO) has fined Cathay Pacific Airways Limited £500,000 for failing to protect the security of its customers’ personal data.

Between October 2014 and May 2018 Cathay Pacific’s computer systems lacked appropriate security measures which led to customers’ personal details being exposed, 111,578 of whom were from the UK, and approximately 9.4 million more worldwide.
The airline’s failure to secure its systems resulted in the unauthorised access to their passengers’ personal details including: names, passport and identity details, dates of birth, postal and email addresses, phone numbers and historical travel information.

Steve Eckersley, ICO Director of Investigations, said:

“People rightly expect when they provide their personal details to a company, that those details will be kept secure to ensure they are protected from any potential harm or fraud. That simply was not the case here.
“Under data protection law organisations must have appropriate security measures and robust procedures in place to ensure that any attempt to infiltrate computer systems is made as difficult as possible.”
Click to expand...

Strengthened UK and European data protection laws came into force in 2018, however due to the timing of these incidents the ICO investigated this case under the Data Protection Act 1998.
Click to expand...

Log in or Sign up

Cathay Pacific flags data breach affecting 9.4 million passengers

guest Guest

EASTER Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

Log in or Sign up

Cathay Pacific flags data breach affecting 9.4 million passengers

guest Guest

EASTER Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

Useful Searches