7 ms·
Hackers leak Qantas data on 5M customers after ransom deadline passes
- Workaccount2 1y ago>customers’ email addresses, phone numbers, birth dates and frequent flyer numbers So all things that have likely been leaked 30 times already? Perhaps except the fly miles
- amelius 1y agoYes, it's a sad situation we're in. We need am indirection step in addresses. So companies don't have our actual address but instead have a handle they can use to interact with that address. And then the actual addresses should be guarded with more responsibility.
- sidpatil 1y agoJapan Post is rolling out such a system: https://news.ycombinator.com/item?id=44117779 https://news.ycombinator.com/item?id=44117779
- ceejayoz 1y agoApple also does it via “hide my email”.
- dns_snek 1y agoBut that's just an identifier which you can easily update when you move, like a domain=>IP mapping? Businesses still have your physical address. A system where they didn't get our address at all would be great but I think we would also need alternative payment providers that don't share any billing-related address information with the business.
- atonse 1y agoI love this idea, but then doesn’t it create a centralized target for hackers? I suppose that’s still better cuz then it also creates a centralized point and resources for securing the database.
- LPisGood 1y agoIt’s weird to think that just a few years ago your phone number and address were shared with tens of thousands of people in a massive book. I feel like if you have someone’s name, it’s not hard at all to find their birthday
- djmips 1y agoI bet the a White Pages publishers are kicking themselves that they never thought of extortion!
- makeitdouble 1y agoAnd you paid every year to not be listed. The core principle was indeed similar.
- esseph 1y agoMore details further in there, but they also leaked passport data.
- arresin 1y agoIs this from the Salesforce breach?
- edm0nd 1y agoYes
- linhns 1y agoHaven’t they sold that to some dubious partners already?
- Noumenon72 1y agoI don't see why a company would pay a ransom to protect their customers from identity theft -- the losses are public, while the costs to them are a very small number of customers that read about this, think they're likely to lose the data again, didn't already lose their data in this leak, remember this story at the time of purchase, and value that more than things like ticket time or ticket price. I don't think the hackers should be making any money this way.
- bwfan123 1y agoWe have public agencies like the police that are paid for by the tax-payers for securing property. Are there similar agencies who are incentivized to stop these situations. During the pipeline breaches several years back, I recall aggressive action to disrupt the money-trail.
- dablya 1y agoTo the extent these situation are as illegal as property theft, public agencies tasked with law enforcement, like the police, are in the same position to secure your data as they are to secure your property, no?
- Bairfhionn 1y agoThe only thing that would prevent this from happening would be if the companies make their stuff safe. You can't police the world.
- shiandow 1y agoI think ransom is also a bit of a misnomer that the hackers deliberately use to frame the transaction in a more positive light. I mean, it's just extortion. Nothing is being ransomed, you don't get something back and you can't really secure something already lost. It suffers from the same problems as other forms of extortion, namely that you can't really trust the other party to do what you want and really they have no incentive to do so.
- chii 1y ago
- chronci739 1y agoPay the ransom, hackers then sell the data privately Don’t pay the ransom, hackers release a subset to the public for free, then sell the rest privately Good on Quantas for not negotiating, bad on them for shit security.
- chii 1y ago> Good on Qantas for not negotiating they probably didnt feel that there was a threat, as privacy of their customer's data wasn't very high on their priority list - after all, they didnt secure that data very well in the first place leading to the stolen data!
- stevetron 1y agoI'd never heard of Quantas. I have heard of Salesforce. Nothing particularly glowing, though.
- edm0nd 1y agoThat just means you arent Australian. Every Australian has heard of Quantas.
- sammy2255 1y agoQantas*
- hitarpetar 1y agoKwantas*
- ruszki 1y agoOr if you visit Australia, there is a high chance to get to know it. At least, it was impossible for me to avoid it when I planned my visit there.
- OccamsMirror 1y agoOr if you've seen Rainman.
- NedF 1y ago[dead]
- nomilk 1y ago> The Qantas data, which was stolen from a Salesforce database in a major cyber-attack in June, included customers’ email addresses, phone numbers, birth dates and frequent flyer numbers. It did not contain credit card details, financial information or passport details. Curious, what's the worst a bad actor do with name, email address, phone number and birth date?
- spwa4 1y agoAuthenticate to phone banking in the name of a customer and request a personal loan. And in general, open a large line of credit in someone else's name.
- SteveNuts 1y agoWhere can you do all that without a social security number?
- whatevaa 1y agoIt's not like those numbers haven't already been leaked elsewhere.
- sammy2255 1y agoThere's no concept of social security number in Australia
- esseph 1y agoI feel like I get about a notification every 2 months now for a service I used maybe once 5 or 10 years ago getting breached/extorted/leaked.
- airstrike 1y agoA SSN should never be used as a "password".
- anonzzzies 1y agoThis you can do somewhere? My bank asks me 20 questions (many like my first pet name, the last transaction I did etc) and then calls me back on the registered phone number. That data alone should get you nothing really. For credit here , small or large, you have to prove you are you or you get a nice police escort. Most of these apps, even if you are already registered, want you to tap your passport to nfc and scan your face for anything serious.
- bilekas 1y agoThis topic is always a mixed bag for me, on the one hand I don't think you should pay ransom groups as it encourages more, but also their security should be better. > “No company wants to see, you know, hundreds of thousands, or, millions of records of their customers just on the internet,” Kirk said. “That’s awful. It’s awful for the companies. It’s awful for the people affected.” This reads to me like : "Well yeah sorry to our customers, but we're not taking a loss for our incompetance" There's no winners here.
- asdefghyk 1y agoI see a class action coming against Qantas .....
- _aobj 1y ago[dead]
- realaaa 1y agoI mean seriously - how the heck are they doing such social engineering?? meanwhile I am struggling to confirm my identity to Google, what the .. :`)