Air Canada has reported a significant data breach affecting roughly 20,000 of its 1.7 million mobile app users. The airline confirmed that it detected unusual login activity on its platform over a two-day span from August 22 to August 24. During this period, personal information for certain customers may have been accessed without proper authorization.
The compromised data includes basic identifiers such as names, email addresses, and phone numbers, which customers have added to their profiles. More concerning, however, is that sensitive information may also have been exposed, including passport numbers, passport expiration dates, and other personal identifiers such as Aeroplan numbers and known traveler information. If users had this data stored, it poses a severe risk.
In light of the breach, Air Canada has reassured its customers regarding the security of their credit card information, stating that such data is encrypted in accordance with the payment card industry standards. Nonetheless, the airline has urged affected customers to closely monitor their financial transactions for any unauthorized activities.
Given that approximately 1% of Air Canada’s mobile app users are estimated to be impacted, the airline has taken proactive measures by temporarily locking down all user accounts. This precautionary step mandates that all users, even those not directly affected, are required to reset their passwords. The airline is advising users to create strong passwords that meet specified guidelines, including a minimum length and the inclusion of symbols.
While the exact method of the attack remains unclear, whether due to a direct breach of Air Canada’s systems or password reuse from external sites, the situation highlights the importance of robust security protocols for businesses. Based on the MITRE ATT&CK framework, potential tactics employed in this incident could encompass initial access through credential dumping or exploitation of weak passwords.
As part of its response, Air Canada has begun emailing users who may have been affected, informing them of the potential unauthorized access to their accounts. This step not only complies with best practices in incident response but also demonstrates a commitment to transparency in security breaches.
For business owners, this incident serves as a stark reminder of the cybersecurity landscape’s volatility and the imperative for meticulous risk management strategies. Regular audits of personal data security, user education on password management, and rapid incident response plans are essential components of safeguarding sensitive information against emerging threats.
