The attackers had a way in for years before anyone noticed. Britain’s Information Commissioner’s Office has now fined Cathay Pacific over a breach that exposed the data of 9.4 million people worldwide, 111,578 of them in the UK.
The penalty is £500,000, cut by 20% to £400,000 if paid by 12 March 2020. Business Standard reported the fine as HK$5 million. The ICO cited “a number of basic security inadequacies.”
What was taken
In October 2018 the Hong Kong-based airline admitted that hackers had broken into its internal systems. The stolen records included names, nationalities, dates of birth, phone numbers, email and postal addresses, passport details, frequent flier numbers and historical travel information.
Business Standard also reported that credit card details were among the data exposed.
A breach years in the making
The intrusion, it turns out, dated back to at least 15 October 2014. Cathay Pacific did not identify it until May 2018, when it became aware of a brute force attack on its Active Directory database.
The later investigation found two separate groups of attackers. One had installed password-stealing malware and used the harvested credentials to reach admin systems.
Cathay Pacific told the ICO on 25 October 2018, five months after it found the problem. It said the delay came from the months it took to analyze the data and understand the impact. The airline’s share price fell after critics said it had taken too long to come clean.
The failures the ICO listed
The regulator pointed to several lapses. Database backups holding personal data were not encrypted. An internet-facing server had not been patched against a vulnerability that had been public knowledge for more than 10 years. Servers handling sensitive data ran on old operating systems that no longer had vendor support.
The detail that matters most is the VPN. About 41,000 users could get in with just a username and password. The ICO said: “If Cathay Pacific had required MFA for every user, the attackers would not have been able to use the stolen credentials to access the VPN and the data breach would have been avoided.”
The airline did begin rolling out multi-factor authentication to all users in September 2018. Bitdefender, which covered the ICO’s findings, noted that this should have happened much sooner.
Cathay is not the only airline to attract the watchdog’s attention. British Airways was revealed the previous July to be facing a £183 million ICO fine after hackers harvested travellers’ data.
Sources
- Cathay Pacific slammed for security failures following hack which exposed 9.4 million people worldwide
- Cathay Pacific fined by UK watchdog for data breach of 9 million fliers
