Breach Exposes Personal Data Of 1.2M SpiceJet Passengers In India

A breach of India’s SpiceJet, one of the country’s biggest independent airlines, exposed the data of more than a million passengers, per a report on Thursday (Jan. 30), citing a security researcher.

The cyberattack exposed records that included passengers’ names, contact information and birthdates, the researcher told the news outlet. Some of the affected customers were said to be authorities.

The breach was supposedly discovered via white-hat or ethical hacking, the security researcher said. The name of the hacker was withheld due to possible violations of U.S. computer hacking regulations.

The security researcher got into SpiceJet’s network last month by “brute-forcing” the system’s weak password. An unencrypted backup file included the personal details of more than 1.2 million passengers. The data archive also contained flight details for each commuter. According to the researcher said, the data would not have been difficult to find for those who knew where to go.

SpiceJet was informed about the breach, but the response was minimal. A sample customer file and the researcher’s correspondence with the airline were reviewed by the news outlet.

The government bureau CERT-In, which manages cybersecurity issues in India, was also informed of the breach, the researcher said. CERT-In reaffirmed that a security lapse had taken place and told SpiceJet. The airline then took steps to secure the database.

“At SpiceJet, the safety and security of our fliers’ data is sacrosanct. Our systems are fully capable and always up to date to secure the fliers’ data, which is a continuous process,” an airline spokesperson said in a statement. “We undertake every possible measure to safeguard and protect this data and ensure that privacy is maintained at the highest and safest level.”

An estimated 12 million passengers fly in India per month. SpiceJet holds roughly 13 percent of the country’s aviation market share. The airline has in excess of 600 planes in the air daily, including some that connect India to foreign destinations.

In September of 2019, SpiceJet announced that it was selling shares in its cargo division in an initial public offering (IPO). The airline is expected to be listed on a stock exchange by September of this year.