American Airlines and Southwest Airlines reveal data breaches that affect their pilots.
American Airlines and Southwest Airlines, two of the largest airlines in the world, disclosed on Friday data breaches caused by the breach of Pilot Credentials, a third-party provider that manages applications and hiring portals for pilots of many airlines.
See also: Powerful JavaScript Dropper PindOS Distributes Bumblebee and IcedID Malware
Both airlines were notified of the pilot credentials incident on May 3, which was limited solely to the third-party vendor's systems - there was no breach or impact on the airlines ' own networks or systems .
An unauthorized individual gained access to Pilot Credentials’ systems on April 30 and stole documents containing information that had been provided by certain applicants during the pilot and examiner recruitment process.
According to the breach notifications filed on Friday at the Office of the Attorney General of Maine, American Airlines reported that the data breach affected 5.745 pilots and applicants, while Southwest reported a total of 3.009.
"Our investigation found that the data involved contained some of your personal information, including your name and Social Security number, driver's license number, passport number, date of birth, airline certificate number, and other government-issued identification numbers," American Airlines revealed.
While no evidence was found indicating that pilots' personal data was targeted or used specifically for fraud or identity theft, the airline will now direct all pilot applicants and candidates to self‑managed internal portals.
See also: NSA: To kill BlackLotus malware, patch is a good start
American Airlines and Southwest Airlines have also notified relevant law enforcement authorities of the violations and are cooperating fully with their ongoing investigations into the matter.
American Airlines has also been affected by other breaches in recent years.
The disclosures come after the revelation of another data breach by American Airlines in September 2020, which affected more than 1.708 customers and members of the American Airlines team after a “phishing” attack in July 2020, which led to the breach of many employee email accounts.
As revealed at the time, the July 2022 breach may have exposed personal information, such as employee and customer names, dates of birth, mailing addresses, phone numbers, email addresses, driver's license numbers, passport , and/or certain medical information.
A later investigation also showed that the attackers had used the compromised employee accounts to send more electronic “phishing” messages.
In March 2021, American Airlines was also hit by a data breach, after global aviation information technology giant SITA revealed that hackers had breached its servers and accessed its Passenger Service System (PSS), which is used by many airlines worldwide.
See also: Super Mario 3: Mario Forever – Malicious version infects Windows devices
American Airlines is the largest airline in the world based on fleet size, with over 1,300 aircraft on its main route. It operates nearly 6,700 flights daily to about 350 destinations in more than 50 countries and employs over 120,000 staff.
Southwest Airlines is the world's largest low‑cost carrier, employing nearly 70,000 staff and operating in more than 121 airports across eleven countries.
Information source: bleepingcomputer.com
