7 ms·

Cathay Pacific flags data breach affecting 9.4M passengers

69 points by sexy_seedbox 8y ago

pandapower2 8y ago
>data of about 9.4 million passengers of Cathay and its unit Hong Kong Dragon Airlines Limited had been accessed without authorization. >860,000 passport numbers, about 245,000 Hong Kong identity card numbers, 403 expired credit card numbers and 27 credit card numbers with no card verification value (CVV) were accessed in the breach. Those numbers don't seem to add up to anything close to 9.4 million. Feel like I'm missing something.
- Lazare 8y ago
  My assumption is a bunch of "less critical" info on ~8m pasengers was accessed (phone numbers? names?), and then ~1m had passport or credit card numbers leaked, and they itemised the "more important" ones explicitly. It doesn't make a lot of sense however I parse it, but that's the only thing that makes the numbers work.
- Arn_Thor 8y ago
  SCMP reports: "Information consists of passengers’ names, nationalities, dates of birth, identity card numbers and historical travel details." So for the majority it'll be one or more of those data sets.
jwr 8y ago
I wonder how long until companies start regarding customer data as a liability (and a risky one at that), rather than an asset.
- iscrewyou 8y ago
  When CEOs start getting jailed. CEOs are ultimately responsible. Especially if they are going to justify high salaries for themselves. Fines mean nothing.
  - ipsum2 8y ago
    This makes no sense. Imagine a junior engineer forgetting to sanitize some inputs, leading to SQL injection. Should the CEO really be put in prison for that? Should the engineer be jailed?
    - craftyguy 8y ago
      Why doesn't the engineer's manager require code reviews for all check-ins/patches before running in production? Why doesn't the CEO, or anyone between the CEO and the engineer, mandate that all engineers writing production code take courses in writing safer code (e.g. sanitize all input, no exceptions)? Why doesn't the CEO pay for code audits? I wonder how many companies who have 'leaked' data recently are doing these things. Granted, it will never catch all bugs, but avoiding these things is negligence, which should be punishable.
    - jay_kyburz 8y ago
      But the CEO can set a policy of deleting information that is not required, and making sure that policy is followed. Cathay Pacific could choose not to keep all that information.
    - chopin 8y ago
      The CEO makes what, like 100 times of that what a junior makes. Why shouldn't he responsible? He cannot account for that much money through his pure workload but only by taking up responsibility. Criminalization is wrong, though. Put the company to death, that's enough. Even the high penalties of GDPR already cause changes of management behavior (at least where I work).
- ruskerdax 8y ago
  To my knowledge there are very few negative consequences, outside of the immediate and obvious ones like reputation, that actually occur when companies leak customer data. I suspect they won't regard keeping vast troves of customer data as a liability until that changes.
  - awill 8y ago
    Just look at Facebook. How many people have deleted their accounts...
    - ruskerdax 8y ago
      I strongly suspect the amount of money Facebook makes utilizing that data greatly outweighs the cost incurred by the "customers" they've lost as a result of poor data handling.
- craftyguy 8y ago
  Doing so will require regulation, and the current US government is against any/all regulation. So I'd say at least 2 more years of further 'data leak' bullshit until we have a real shot of doing something to motivate companies to treat customer data appropriately.
- artursapek 8y ago
  I just made this case to my coworkers recently to defend our use of a hard delete in our customer database, as opposed to a "soft delete" boolean column.
- emmanuel_1234 8y ago
  I work in a so called "Big Data" startup. We go to great extent to not have any kind of Personally Identifiable Information, because the liability is way too big. It really sucks when a client accidentally send us a list of their customers email and we have to clean up everybody's inbox.
- jen729w 8y ago
  I’m busy building a little tool that I hope I can sell as a SaaS one day and this is absolutely forefront in my mind. I do not want any of your data, above that which I must hold for the service to be useful. It’s just a liability. See also: Marco Arment, maker of the Overcast podcast player, pushing people to take their accounts anonymous [0]. It’s just good business sense at this point. I also plan on having zero trackers. I’ll just get over the fact that I’ll have no visibility of users on my site other than what I can glean from public forums or, you know, actual paid sign-ups. It’s all too fraught with leak risk and I can’t be bothered. [0]: https://marco.org/2018/04/27/overcast42 https://marco.org/2018/04/27/overcast42
- awill 8y ago
  It would only be a liability if there were serious punishment.
- confounded 8y ago
  When there is meaningful regulation, serious consequences, and enforcement agencies with teeth.
- closeparen 8y ago
  Under what circumstances do you think an airline would choose not to know its passengers? This isn’t adtech.
ryandrake 8y ago
Interesting how it’s always worded in a way that frames the negligent company as the victim instead of the customers whose data was exfiltrated: “Company X was attacked by hackers,” “Company Y was the victim of a data breach.” Its never: “Company Z failed to secure customers’ information.”
- dx87 8y ago
  I used to do contract pentesting for a big fortune 500 company, and they were able to cut all kinds of security corners because they knew people would perceive them as the victim. The person running our contract at the company said that the people making budget decisions know that at worst there'll be a small stock dip for 1-2 days in the event of a compromise, so they said it's not worth the money to actually have good security because the general public will just see the headlines and consider the company the equivalent of a robbery victim.
  - TheSpiceIsLife 8y ago
    When people say there are no consequences for the company yadda yadda yadda what they neglect to also mention is that, typically, there are no consequences for those affected either. If the one billion odd people affected by major data breaches since 2005¹ all experienced some significant difficulty as a result, we could probably expect a louder outcry and subsequent changes in behaviour by those we entrust(?) our personal identifying information to. I've been online since well before 2005, and the worst I've experience is one debit card being cancelled due to a failed fraudulent transaction attempt ~10 years ago, and ~2 months ago a successful fraudulent transaction of AU$13.36 which I noticed immediately (thanks mobile banking app notifications), which resulted in the me calling and cancelling the card and the charge being reversed. Of course, we're all paying more in fees due to insurance against such events, but that appears to be an inconvenience that most people simply don't rate. 1. https://news.ycombinator.com/item?id=18297966 https://news.ycombinator.com/item?id=18297966
- confounded 8y ago
  At least in the UK the banks and the police have worked together for years to establish “identity theft” as a thing. From: Whoops we gave a loan to a stranger because they tricked us! To: You owe us money because someone stole the core of yourself, from yourself, without you noticing The police get to move a whole load of theft out of their crime statistics as it modernizes, and the banks get to avoid lots of ‘red tape’ and can decide how nice they want to be to each victim (or rather, how profitable being nice is).
lathiat 8y ago
> Hogg said no passwords were compromised in the breach and the company was contacting affected passengers to give them information on how to protect themselves. Well that's good! My precious password that can be easily changed wasn't leaked! > Cathay in a statement said accessed data includes names of passengers, their nationalities, dates of birth, telephone numbers, email and physical addresses, passport numbers, identity card numbers and historical travel information. oh...
- noobermin 8y ago
  I hear you. One issue is that most people use similar passwords for all their services, which yes is problematic and a travesty but that's how it is. So getting someone's name and personal information (that yes, can also be used for identity theft) is not as bad as now having a list of names and passwords to try to use on bank websites, for example.
  - nicolas_t 8y ago
    Passport number + date of birth and name is enough for a social engineering attack against a lot of banks (hopefully they didn't like my credit card BIN to make it extra helpful to identify my bank). So my passport number leaking is personally much worse for me than if my password leaked (which I'm very careful to protect).
    - jfaat 8y ago
      Do a lot of banks have access to your passport number and use that as identifying info or is there another leg like passport -> ssn -> bank?
      - culturestate 8y ago
        If you live (and are opening a bank account) in a country other than your own, your passport is one of the only ways to prove your identity for KYC. I had to show both my HKID and my passport to get an account at HSBC, and I can use either of them as ID at the teller window.
tzhenghao 8y ago
I don't know why, this reminds me of Singapore Airline's account login/signup flow. It's cringy to think that the only allow 6 numbers for their password field. Yes, in 2018!
- rdtsc 8y ago
  That usually means they are on some kind of ancient mainframe.
  - acct1771 8y ago
    Wouldn't a workaround for this be storing the (smaller) hash of a better passphrase, and using that to authenticate once arrive at the "vital bits"? Then again...someone complacent enough to get that far behind in infrastructure probably doesn't have any chance of that being thought of/appoved.
    - rdtsc 8y ago
      > Then again...someone complacent enough to get that far behind in infrastructure probably doesn't have any chance of that being thought of/appoved. I see you've worked in the enterprise? :-) Another reason is that nobody knows how it really works. The people who knew have long retired. The fear is updating it will likely introduce subtly new behavior and new bugs that everyone is scared of touching it.
- markdown 8y ago
  My bank (Westpac) only allows 6 alphanumeric characters in their passwords.
  - sduff 8y ago
    And that same bank doesn't distinguish between upper and lower case characters in the password either.
  - samtoday 8y ago
    Westpac's interface is quite funny. Only very recently did they allow pasting passwords from a password manager, previously you had to use an on screen keyboard (presumably to stop keyloggers). On that note; any recommendations for Aussie banks that have a secure and modern interface?
TheSpiceIsLife 8y ago
So, I just glanced through this¹ Wikipedia entry and quickly added up all the numbers in the yearly lists of major data breaches and came up with this number: 929 million users / customers affected by major data breaches since 2005. There's probably at least some / a whole lot of overlap in some, but still... Thusly, it'd be unusual if any particular individual hasn't had at least some of their identity go astray. 1. https://en.wikipedia.org/wiki/Data_breach https://en.wikipedia.org/wiki/Data_breach
- Area12 8y ago
  Seriously, check out Troy Hunt's Have I Been Pwned? https://haveibeenpwned.com/PwnedWebsites https://haveibeenpwned.com/PwnedWebsites
nicolas_t 8y ago
Just realized that with the information leaked (passport number , birthday, name and asiamiles/MPC number), it would be enough to do the phone verification with them and redeem miles from the account. So, not having leaked passwords is really not that much of an achievement.
0xmohit 8y ago
It'd be good if there was a law that'd fine corporations for being unable to protect user data. Make the fine directly proportional to: number of people affected * bits of leaked data for each user.
graystevens 8y ago
Reposting from the other thread at https://news.ycombinator.com/item?id=18299015* https://news.ycombinator.com/item?id=18299015* It is unclear from any reporting as to how this technically happened, which is a shame but hopefully that will be made public in the coming days. Some other outlets[0] have an interesting statement: > The breach also included details about where each passenger had traveled and any comments made by customer service representatives. The amount of data accessed varied among passengers.* Based on those details, and the mention of 'no passwords were compromised', chances are this breach has come from an internal helpdesk type system, or possibly CRM. If however the statement around the passwords changes, that opens up a few other possibilities. What this doesn't sound like, are the attacks we saw on British Airways[1] and Ticketmaster[2], where javascript was injected into the payment pages to vacuum up payment details from customers. The statement around "The company has no evidence that any personal information has been misused" is always an interesting one, and is one of the many reasons I created my startup Breach Insider[3], so that data breaches like this could be detected much sooner (not 7 months later, as we have seen here), with minimal false positive alerts, and definitive evidence if any data has been misused. By using real email addresses that are unique to each company/business, you can be sure to find out if that data ever leaks & is abused for things like spam or phishing. [0] https://www.theverge.com/2018/10/24/18019958/cathay-pacific-airline-data-breach https://www.theverge.com/2018/10/24/18019958/cathay-pacific-... [1] https://www.britishairways.com/en-gb/information/incident/data-theft/latest-information# https://www.britishairways.com/en-gb/information/incident/da... [2] https://www.riskiq.com/blog/labs/magecart-ticketmaster-breach/ https://www.riskiq.com/blog/labs/magecart-ticketmaster-breac... [3] https://breachinsider.com https://breachinsider.com
kevcampb 8y ago
One important thing to note. PCCW the main local telco uses Hong Kong ID numbers as passwords by default, or at least they used to do so. This means that this database contains usernames and passwords in cleartext for a significant number of users who have never changed their accounts.
- slygent 8y ago
  Certainly not just PCCW: https://webb-site.com/dbpub/subject.asp?t=72 https://webb-site.com/dbpub/subject.asp?t=72
throwaways123 8y ago
Just got an email. My name and addressed was leaked from this breach. Even the email they sent the message from has failed domain authentication. They have become a joke to me.
syntaxing 8y ago
I'm curious how this is going to be handled by the HK government. Hong Kong does have a privacy bureau (PCPD) but I am not sure what their jurisdiction is and what litigation weapons they have. That being said, Cathay Pacific has been really going downhill these past couple of years. Not surprised that their IT side of things are effected as well.

69 points by sexy_seedbox 8y ago

>data of about 9.4 million passengers of Cathay and its unit Hong Kong Dragon Airlines Limited had been accessed without authorization. >860,000 passport numbers, about 245,000 Hong Kong identity card numbers, 403 expired credit card numbers and 27 credit card numbers with no card verification value (CVV) were accessed in the breach. Those numbers don't seem to add up to anything close to 9.4 million. Feel like I'm missing something.

Lazare 8y ago
My assumption is a bunch of "less critical" info on ~8m pasengers was accessed (phone numbers? names?), and then ~1m had passport or credit card numbers leaked, and they itemised the "more important" ones explicitly. It doesn't make a lot of sense however I parse it, but that's the only thing that makes the numbers work.
Arn_Thor 8y ago
SCMP reports: "Information consists of passengers’ names, nationalities, dates of birth, identity card numbers and historical travel details." So for the majority it'll be one or more of those data sets.

jwr 8y ago

I wonder how long until companies start regarding customer data as a liability (and a risky one at that), rather than an asset.

iscrewyou 8y ago
When CEOs start getting jailed. CEOs are ultimately responsible. Especially if they are going to justify high salaries for themselves. Fines mean nothing.
- ipsum2 8y ago
  This makes no sense. Imagine a junior engineer forgetting to sanitize some inputs, leading to SQL injection. Should the CEO really be put in prison for that? Should the engineer be jailed?
  - craftyguy 8y ago
    Why doesn't the engineer's manager require code reviews for all check-ins/patches before running in production? Why doesn't the CEO, or anyone between the CEO and the engineer, mandate that all engineers writing production code take courses in writing safer code (e.g. sanitize all input, no exceptions)? Why doesn't the CEO pay for code audits? I wonder how many companies who have 'leaked' data recently are doing these things. Granted, it will never catch all bugs, but avoiding these things is negligence, which should be punishable.
  - jay_kyburz 8y ago
    But the CEO can set a policy of deleting information that is not required, and making sure that policy is followed. Cathay Pacific could choose not to keep all that information.
  - chopin 8y ago
    The CEO makes what, like 100 times of that what a junior makes. Why shouldn't he responsible? He cannot account for that much money through his pure workload but only by taking up responsibility. Criminalization is wrong, though. Put the company to death, that's enough. Even the high penalties of GDPR already cause changes of management behavior (at least where I work).
ruskerdax 8y ago
To my knowledge there are very few negative consequences, outside of the immediate and obvious ones like reputation, that actually occur when companies leak customer data. I suspect they won't regard keeping vast troves of customer data as a liability until that changes.
- awill 8y ago
  Just look at Facebook. How many people have deleted their accounts...
  - ruskerdax 8y ago
    I strongly suspect the amount of money Facebook makes utilizing that data greatly outweighs the cost incurred by the "customers" they've lost as a result of poor data handling.
craftyguy 8y ago
Doing so will require regulation, and the current US government is against any/all regulation. So I'd say at least 2 more years of further 'data leak' bullshit until we have a real shot of doing something to motivate companies to treat customer data appropriately.
artursapek 8y ago
I just made this case to my coworkers recently to defend our use of a hard delete in our customer database, as opposed to a "soft delete" boolean column.
emmanuel_1234 8y ago
I work in a so called "Big Data" startup. We go to great extent to not have any kind of Personally Identifiable Information, because the liability is way too big. It really sucks when a client accidentally send us a list of their customers email and we have to clean up everybody's inbox.
jen729w 8y ago
I’m busy building a little tool that I hope I can sell as a SaaS one day and this is absolutely forefront in my mind. I do not want any of your data, above that which I must hold for the service to be useful. It’s just a liability. See also: Marco Arment, maker of the Overcast podcast player, pushing people to take their accounts anonymous [0]. It’s just good business sense at this point. I also plan on having zero trackers. I’ll just get over the fact that I’ll have no visibility of users on my site other than what I can glean from public forums or, you know, actual paid sign-ups. It’s all too fraught with leak risk and I can’t be bothered. [0]: https://marco.org/2018/04/27/overcast42 https://marco.org/2018/04/27/overcast42
awill 8y ago
It would only be a liability if there were serious punishment.
confounded 8y ago
When there is meaningful regulation, serious consequences, and enforcement agencies with teeth.
closeparen 8y ago
Under what circumstances do you think an airline would choose not to know its passengers? This isn’t adtech.

ryandrake 8y ago

Interesting how it’s always worded in a way that frames the negligent company as the victim instead of the customers whose data was exfiltrated: “Company X was attacked by hackers,” “Company Y was the victim of a data breach.” Its never: “Company Z failed to secure customers’ information.”

dx87 8y ago
I used to do contract pentesting for a big fortune 500 company, and they were able to cut all kinds of security corners because they knew people would perceive them as the victim. The person running our contract at the company said that the people making budget decisions know that at worst there'll be a small stock dip for 1-2 days in the event of a compromise, so they said it's not worth the money to actually have good security because the general public will just see the headlines and consider the company the equivalent of a robbery victim.
- TheSpiceIsLife 8y ago
  When people say there are no consequences for the company yadda yadda yadda what they neglect to also mention is that, typically, there are no consequences for those affected either. If the one billion odd people affected by major data breaches since 2005¹ all experienced some significant difficulty as a result, we could probably expect a louder outcry and subsequent changes in behaviour by those we entrust(?) our personal identifying information to. I've been online since well before 2005, and the worst I've experience is one debit card being cancelled due to a failed fraudulent transaction attempt ~10 years ago, and ~2 months ago a successful fraudulent transaction of AU$13.36 which I noticed immediately (thanks mobile banking app notifications), which resulted in the me calling and cancelling the card and the charge being reversed. Of course, we're all paying more in fees due to insurance against such events, but that appears to be an inconvenience that most people simply don't rate. 1. https://news.ycombinator.com/item?id=18297966 https://news.ycombinator.com/item?id=18297966
confounded 8y ago
At least in the UK the banks and the police have worked together for years to establish “identity theft” as a thing. From: Whoops we gave a loan to a stranger because they tricked us! To: You owe us money because someone stole the core of yourself, from yourself, without you noticing The police get to move a whole load of theft out of their crime statistics as it modernizes, and the banks get to avoid lots of ‘red tape’ and can decide how nice they want to be to each victim (or rather, how profitable being nice is).

lathiat 8y ago

> Hogg said no passwords were compromised in the breach and the company was contacting affected passengers to give them information on how to protect themselves. Well that's good! My precious password that can be easily changed wasn't leaked! > Cathay in a statement said accessed data includes names of passengers, their nationalities, dates of birth, telephone numbers, email and physical addresses, passport numbers, identity card numbers and historical travel information. oh...

noobermin 8y ago
I hear you. One issue is that most people use similar passwords for all their services, which yes is problematic and a travesty but that's how it is. So getting someone's name and personal information (that yes, can also be used for identity theft) is not as bad as now having a list of names and passwords to try to use on bank websites, for example.
- nicolas_t 8y ago
  Passport number + date of birth and name is enough for a social engineering attack against a lot of banks (hopefully they didn't like my credit card BIN to make it extra helpful to identify my bank). So my passport number leaking is personally much worse for me than if my password leaked (which I'm very careful to protect).
  - jfaat 8y ago
    Do a lot of banks have access to your passport number and use that as identifying info or is there another leg like passport -> ssn -> bank?
    - culturestate 8y ago
      If you live (and are opening a bank account) in a country other than your own, your passport is one of the only ways to prove your identity for KYC. I had to show both my HKID and my passport to get an account at HSBC, and I can use either of them as ID at the teller window.

tzhenghao 8y ago

I don't know why, this reminds me of Singapore Airline's account login/signup flow. It's cringy to think that the only allow 6 numbers for their password field. Yes, in 2018!

rdtsc 8y ago
That usually means they are on some kind of ancient mainframe.
- acct1771 8y ago
  Wouldn't a workaround for this be storing the (smaller) hash of a better passphrase, and using that to authenticate once arrive at the "vital bits"? Then again...someone complacent enough to get that far behind in infrastructure probably doesn't have any chance of that being thought of/appoved.
  - rdtsc 8y ago
    > Then again...someone complacent enough to get that far behind in infrastructure probably doesn't have any chance of that being thought of/appoved. I see you've worked in the enterprise? :-) Another reason is that nobody knows how it really works. The people who knew have long retired. The fear is updating it will likely introduce subtly new behavior and new bugs that everyone is scared of touching it.
markdown 8y ago
My bank (Westpac) only allows 6 alphanumeric characters in their passwords.
- sduff 8y ago
  And that same bank doesn't distinguish between upper and lower case characters in the password either.
- samtoday 8y ago
  Westpac's interface is quite funny. Only very recently did they allow pasting passwords from a password manager, previously you had to use an on screen keyboard (presumably to stop keyloggers). On that note; any recommendations for Aussie banks that have a secure and modern interface?

TheSpiceIsLife 8y ago

So, I just glanced through this¹ Wikipedia entry and quickly added up all the numbers in the yearly lists of major data breaches and came up with this number: 929 million users / customers affected by major data breaches since 2005. There's probably at least some / a whole lot of overlap in some, but still... Thusly, it'd be unusual if any particular individual hasn't had at least some of their identity go astray. 1. https://en.wikipedia.org/wiki/Data_breach https://en.wikipedia.org/wiki/Data_breach

Area12 8y ago
Seriously, check out Troy Hunt's Have I Been Pwned? https://haveibeenpwned.com/PwnedWebsites https://haveibeenpwned.com/PwnedWebsites

nicolas_t 8y ago

Just realized that with the information leaked (passport number , birthday, name and asiamiles/MPC number), it would be enough to do the phone verification with them and redeem miles from the account. So, not having leaked passwords is really not that much of an achievement.

0xmohit 8y ago

It'd be good if there was a law that'd fine corporations for being unable to protect user data. Make the fine directly proportional to: number of people affected * bits of leaked data for each user.

graystevens 8y ago

Reposting from the other thread at https://news.ycombinator.com/item?id=18299015* https://news.ycombinator.com/item?id=18299015* It is unclear from any reporting as to how this technically happened, which is a shame but hopefully that will be made public in the coming days. Some other outlets[0] have an interesting statement: > The breach also included details about where each passenger had traveled and any comments made by customer service representatives. The amount of data accessed varied among passengers.* Based on those details, and the mention of 'no passwords were compromised', chances are this breach has come from an internal helpdesk type system, or possibly CRM. If however the statement around the passwords changes, that opens up a few other possibilities. What this doesn't sound like, are the attacks we saw on British Airways[1] and Ticketmaster[2], where javascript was injected into the payment pages to vacuum up payment details from customers. The statement around "The company has no evidence that any personal information has been misused" is always an interesting one, and is one of the many reasons I created my startup Breach Insider[3], so that data breaches like this could be detected much sooner (not 7 months later, as we have seen here), with minimal false positive alerts, and definitive evidence if any data has been misused. By using real email addresses that are unique to each company/business, you can be sure to find out if that data ever leaks & is abused for things like spam or phishing. [0] https://www.theverge.com/2018/10/24/18019958/cathay-pacific-airline-data-breach https://www.theverge.com/2018/10/24/18019958/cathay-pacific-... [1] https://www.britishairways.com/en-gb/information/incident/data-theft/latest-information# https://www.britishairways.com/en-gb/information/incident/da... [2] https://www.riskiq.com/blog/labs/magecart-ticketmaster-breach/ https://www.riskiq.com/blog/labs/magecart-ticketmaster-breac... [3] https://breachinsider.com https://breachinsider.com

kevcampb 8y ago

One important thing to note. PCCW the main local telco uses Hong Kong ID numbers as passwords by default, or at least they used to do so. This means that this database contains usernames and passwords in cleartext for a significant number of users who have never changed their accounts.

slygent 8y ago
Certainly not just PCCW: https://webb-site.com/dbpub/subject.asp?t=72 https://webb-site.com/dbpub/subject.asp?t=72

throwaways123 8y ago

Just got an email. My name and addressed was leaked from this breach. Even the email they sent the message from has failed domain authentication. They have become a joke to me.

syntaxing 8y ago

I'm curious how this is going to be handled by the HK government. Hong Kong does have a privacy bureau (PCPD) but I am not sure what their jurisdiction is and what litigation weapons they have. That being said, Cathay Pacific has been really going downhill these past couple of years. Not surprised that their IT side of things are effected as well.