For a month, tens of millions of records from two airlines owned by Lion Air were discovered circulating on data-sharing forums. The information was stored in an Amazonthat is open on the web.
The files were discovered in two databases, one containing 21 million records and the other 14 million, in a backup created in May 2019 primarily for Malindo Air and Thai Lion Air.
Another backup file is named Batik Air, an airline whose parent is also Lion Air.
The leaks include passengers' identity and booking details, home addresses, phone numbers, email addresses, names, dates of birth, phone numbers, passport numbers and passport expiration dates.
A researcher, going by the name Under the Breach, published samples of the two databases, taking care to mask the personal details of the passengers.
It is unclear when the data was first leaked, but a user who collects sensitive information from various data-sharing forums posted a link to the Amazon storage site on August 10.
The two databases, which are still available upon request, contain backup files, the most recent of which is from May 25, named “PaymentGateway.”.
The data includes references to the company's frequent flyer program and online booking service GoQuo, which also provides customer analytics solutions.
The names of the listings suggest that a lot of sensitive passenger information was exposed and accessible to unauthorized individuals.
Any personal data obtained poses a risk to the privacy of its owners and there is a high possibility that it could be used by malicious actors for financial gain.
