India’s Newest Airline Akasa Air Found Leaking Passengers’ Personal Information

Products You May Like

Akasa Air, India’s newest commercial airline, exposed the personal data belonging to its customers that the company blamed on a technical configuration error.

According to security researcher Ashutosh Barot, the issue is rooted in the account registration process, leading to the exposure of details such as names, gender, email addresses, and phone numbers.

The bug was identified on August 7, 2022, the same day the low-cost airline commenced its operations in the country.

CyberSecurity

“I found an HTTP request which gave my name, email, phone number, gender, etc. in JSON format,” Borot said in a write-up. “I immediately changed some parameters in [the] request and I was able to see other user’s PII. It took around ~30 minutes to find this issue.”

Airline Akasa Air Suffers Data Breach

Upon receiving the report, the company said it temporarily shut down parts of its system to incorporate additional security guardrails. It has also reported the incident to the Indian Computer Emergency Response Team (CERT-In).

CyberSecurity

Akasa Air emphasized that no travel-related information or payment details were left accessible and that there is no evidence the glitch was exploited in the wild.

The airline further said it has directly notified affected users of the incident, although the scale of the leak remains unclear, adding it “advised users to be conscious of possible phishing attempts.”

Cyber Security

Products You May Like

Articles You May Like

Intel 13th Gen ‘Raptor Lake’ Desktop CPUs Launched, Including Core i9-13900K With 24 Cores
Infinix Note 12i (2022) With MediaTek Helio G85 SoC, 50-Megapixel Rear Camera Launched: Price, Specifications
Researchers Warn of New Go-based Malware Targeting Windows and Linux Systems
NASA Says Artemis I October Launch Will Be ‘Difficult’, Shelters SLS Rocket From Hurricane Ian
Brazilian Prilex Hackers Resurfaced With Sophisticated Point-of-Sale Malware

Leave a Reply

Your email address will not be published.