Global Air Transport Giant SITA Confirms Security Breach
Hundreds of thousands of Star Alliance passengers’ details stolen.
SITA (Société Internationale de Télécommunications Aéronautiques) is one of the largest aviation IT companies, serving around 90% of the world’s airlines, which rely on the company’s passenger service system Horizon to manage reservations, ticketing and aircraft departures. The company issued an official statement on Thursday confirming it had been the subject of a security breach, and that certain passenger data stored on its U.S. servers had been accessed by cybercriminals.
SITA confirms that it was the victim of a cyber-attack, leading to a data security incident involving certain passenger data that was stored on SITA Passenger Service System (US) Inc. servers.
Several airlines including Malaysia Airlines, Finnair, Singapore Airlines; Air New Zealand, and South Korean airline Jeju Air have been notified and have already made statements about the breach.
Heimdal® Threat Prevention - Network
- No need to deploy it on your endpoints;
- Protects any entry point into the organization, including BYODs;
- Stops even hidden threats using AI and your network traffic log;
- Complete DNS, HTTP and HTTPs protection, HIPS and HIDS;
Earlier this week, in an email to affected customers, Singapore Airlines stated the airline was not a customer of SITA’s Horizon passenger service system but that over half a million frequent flyer members had their membership number and tier status compromised.
Around 580,000 KrisFlyer and PPS members have been affected by the breach of the SITA PSS servers. The information involved is limited to the membership number and tier status and, in some cases, membership name, as this is the full extent of the frequent flyer data that Singapore Airlines shares with other Star Alliance member airlines for this data transfer.
The airline said that the data transfer is “necessary to enable verification of the membership tier status, and to accord to member airlines’ customers the relevant benefits while traveling.”
The same attack is believed to be responsible for the Malaysia Airlines security breach that compromised its Enrich frequent flyer data between 2010 and 2019.
Malaysia Airlines was notified of a data security incident at one of its third-party IT service providers which involved some personal data of members of Enrich, Malaysia Airlines’ Frequent Flyer Programme between the period of March 2010 and June 2019. The incident did not affect Malaysia Airlines’ own IT infrastructure and systems in any way.
Together with Sabre and Amadeus, SITA is one of the few aviation companies in the world that provides passenger ticketing and reservation systems to airlines.
Back in 2017, Sabre reported a major data breach that affected the company’s hotel reservation system, after attackers stole more than a million customer credit cards. Following this incident, Sabre made a $2.4 million settlement and agreed to adjust its cybersecurity policies by taking strong measures to protect the interests of its customers and the traveling public.
SITA had nothing more to disclose at this stage except that it will act swiftly to try and contain the threat and that incident responders and third-party specialists are constantly monitoring the situation.