Air India Says 4.5 Million Users' Data Stored over Ten Years Breached in Cyber Attack

Air India's passenger service system provider SITA faced a sophisticated cyberattack in February this year leading to leak of personal data of 4.5 million passengers stored over a period of about ten years. It included data of passengers of the the national carrier from across the world, an official statement said on Friday.

Personal data – including name, date of birth, contact information, passport information, ticket information and credit card data – which was registered between August 26, 2011, and February 20, 2021, of a certain number of Air India's passengers has been leaked, the statement issued by the airline said.

"SITA PSS our data processor of the passenger service system (which is responsible for storing and processing of personal information of the passengers) had recently been subjected to a cybersecurity attack leading to personal data leak of certain passengers. This incident affected around 4,500,000 data subjects in the world," the airline said in an email to its customers.

"While we had received the first notification in this regard from our data processor on 25.02.2021, we would like to clarify that the identity of the affected data subjects was only provided to us by our data processor on 25.03.2021 and 5.04.2021," Air India added in its statement.

Air India data breached in a major Cyber attack. Breach involves Passengers personal Information including Credit Card Info and Passport Details. Other Global Airlines are likely affected too.#airindia #CyberAttack @airindiain@rahulkanwal @sanket @maryashakil pic.twitter.com/XxUORgInJQ

— Jiten Jain (@jiten_jain) May 21, 2021

Its statement mentioned that no password or credit card data was affected and that CVV/CVC numbers on credit cards were not stored in its data processor.

"While we and our data processor continue to take remedial actions...We would also encourage passengers to change passwords wherever applicable to ensure safety of their personal data," it said.

SITA (Société Internationale de Télécommunications Aéronautiques) is based out of Geneva in Switzerland and nearly every passenger flight relies on its IT services. Singapore Airlines and Malaysia Airlines have also informed their passengers that their data had been accessed by an intruder.

While the level and scope of sophistication is being ascertained through forensic analysis and the exercise is ongoing, SITA has confirmed that no unauthorised activity has been detected inside the system's infrastructure after the incident, Air India said.

"Air India meanwhile is in liaison with various regulatory agencies in India and abroad, and has apprised them about the incident in accordance with its obligations," the airline said.

It said that the identity of its affected passengers was provided to it by SITA on March 25 and April 5 only. Air India along with the service provider is carrying out risk assessment and would further update as and when it becomes available, it said.

The airline said it has taken following steps after the data security incident: Secured the compromised servers, engaged external specialists of data security incidents, notified and in talk with the credit card issuers and reset the passwords of Air India frequent flyer programme.

With PTI Inputs