India’s Akasa Air exposed sensitive records of thousands of customers

guest · Sep 3, 2022

By Jagmeet Singh @jagmeets13 - August 28, 2022

Akasa Air, India’s newly launched airline that began operations earlier this month, exposed the personal data of thousands of its customers because of a technical glitch that affected its login and sign-up service.

The exposed data, discovered by cybersecurity researcher Ashutosh Barot, included full names, gender, email addresses and phone numbers of customers signing up and logging in on the Akasa Air website.
Click to expand...

The researcher found an HTTP request disclosing the data minutes after looking at Akasa Air’s website on its inaugural day on August 7. He had initially tried to communicate with the security team at the Mumbai-based airline directly but did not find a direct contact.

”I reached out to the airline via their official Twitter account, asking them for an email ID to report the issue. They gave me the info@akasa email ID to which I didn’t share the vulnerability details because it might be handled by support staff or third party vendors. So, I emailed them again and asked [the airline] to provide [the] email address of someone from their security team. I received no further communication from Akasa,” the researcher said.
Click to expand...

Akasa Air quickly responded when we reached out and acknowledged that the issue had put 34,533 unique customer records at risk. The airline also said the exposed data did not include travel-related information or payment records.

Additionally, the airline told TechCrunch that it carried additional reviews to ensure the security of all its systems.
Click to expand...

Akasa Air reported the incident to India’s nodal cybersecurity agency CERT-In and notified its affected users through a statement that it also made public on Sunday. It advised users “to be conscious of possible phishing attempts” due to the data exposure. Further, it confirmed to TechCrunch that it did not see an “untoward spike in access” to the data.

“I am glad the airline fixed the issue on short notice and reported it to CERT-In as well as informed its customers about the incident, which is an exemplary step,” the researcher said.
Click to expand...

Akasa Air suffers data breach

Temporary technical configuration error related to login and sign-up service was reported on August 25
Click to expand...

Log in or Sign up

India’s Akasa Air exposed sensitive records of thousands of customers

guest Guest

Log in or Sign up

India’s Akasa Air exposed sensitive records of thousands of customers

guest Guest

Useful Searches