Flight booking platform Option Way exposes customer and internal data

guest · Sep 2, 2019

Flight booking platform Option Way exposes customer and internal data
Researchers from vpnMentor security firm have recently discovered a huge data breach in flight booking platform Option Way
September 2, 2019
https://securityaffairs.co/wordpress/90688/uncategorized/option-way-data-breach.html

Option Way service allows its users to find flight deals to and from destinations around the world.
The experts discovered that a huge portion of the database used by the Option Way platform is completely unprotected and unencrypted.

“The company uses an Elasticsearch database, which is ordinarily not designed for URL use. However, we were able to access it via a browser and manipulate the URL search criteria into exposing huge amounts of data.” reads the analysis published by the experts.
The experts discovered over 100GB of data, including unencrypted personal details of customers (Customer names, Date of Birth, Gender, Email addresses, Phone, numbers, Home Address & postcode) and information about users’ flights and travel arrangements.

Experts also discovered that the email addresses of Option Way were accessible as a result of ‘incorrect password’ reset links.
vpnMentor warns that combining leaked data it is possible to create a complete user profile of Option Way customers, exposing them to multiple criminal activities and cyber frauds.
Click to expand...

vpnMentor: Report: Flight Booking Platform Exposes Customer Data

Log in or Sign up

Flight booking platform Option Way exposes customer and internal data

guest Guest

Log in or Sign up

Flight booking platform Option Way exposes customer and internal data

guest Guest

Useful Searches