World airlines are warning passengers of a data leak after an aviation IT supplier was struck by a cyberattack.

International IT supplier to the aviation industry SITA currently supplies its technology services to around 90 percent of airline carriers around the world. Following what has been described as a “highly sophisticated attack”, the company is warning of a large-scale incident involving data security.

Hacker access to passenger data

SITA has now officially stated it has been the victim of a dedicated cyberattack, with the hackers behind the strike obtaining access to airline passengers’ personal information.

The communications and information technology enterprise, which provides services to the vast majority of global airlines, commented that the recent attack led to an incident concerning passenger data records that were being stored on the servers of SITA Passenger Service System Inc., based in Atlanta, in the US state of Georgia.

An official statement made by SITA infers that the event formed a complex and professional attack and that the IT service provider responded quickly in order to contain the unfortunate incident. At present, the cyberattack is still under investigation. SITA’s own Security Incident Response Team is taking an in-depth examination of the event, with support from expert external consultants specialising in cybersecurity.

SITA commented in its recent notification:

“We recognise that the COVID-19 pandemic has raised concerns about security threats, and, at the same time, cyber criminals have become more sophisticated and active.”

Mitigating the impacts of a data breach

Multiple international airlines have now come forward, alerting their passengers to potential threats from the SITA data breach. These include many Star Alliance airlines, such as German carrier Lufthansa, Singapore Airlines and New Zealand Air, as well as One World Airlines, such as Finland’s Finnair, Hong Kong’s Cathay Pacific and Japan Airlines. Additionally, JeJu Air of South Korea has also notified its passengers of the cyber strike on SITA and the risk to their personal data.

Enterprises responsible for information retained on data subjects are obliged to inform them of any exposure and warn against potential harm. Data subjects will typically be told the type of information disclosed and any measures taken to limit risks, as well as warnings regarding how the data may be used by threat actors. For example, they may be advised to watch their bank records and credit scores or be vigilant against malicious communications via email or phone.

Although SITA has not yet confirmed the precise nature of the data that the hackers have accessed, a spokesperson for the firm has revealed that airline passengers’ personal information was included in the breached data.

At present, there is no exact figure available to assess precisely how many passengers have been impacted by the malicious attack, as SITA have not yet made their investigation’s findings available to the public. However, a recent report in The Guardian newspaper suggests that the number of passengers whose information was stolen could be in the hundreds of thousands.