In a sophisticated cyber-attack, the data of 5.8 lakh Singapore Airlines (SIA) frequent flyer members have been compromised in a cybersecurity attack that originally hit air transport communications and IT vendor, SITA .
The incident marks the second time in a week that an airline has reported a data breach, which appears also to be the result of the attack targeting SITA. However, the airlines confirmed the data breach specifically does not involve KrisFlyer and PPS member passwords, credit card information or other customer data.
While not a customer of SITA, Singapore Airlines (SIA) had shared a "restricted" set of data as a member of the Star Alliance group, the airline said in a statement late-Thursday. SIA said in a statement yesterday that members of its KrisFlyer and PPS Club reward programmes have had their membership numbers, tier status and, in some cases, membership names compromised.
The statement claims, that the breach did not involve the members' passwords or credit card information. There was also no leak of itineraries, reservations, ticketing information, passport numbers, and e-mail addresses.
A spokesman for the airline said: "It is not possible for someone to access any confidential customer data or their miles with only the leaked information. SIA said the data breach originated from air transport information technology firm Sita.
All Star Alliance member airlines provide a restricted set of frequent flyer programme data to the alliance, which is then sent on to other member airlines to reside in their respective passenger service systems. SIA said: "All Star Alliance member airlines provide a restricted set of frequent flier programme data to the alliance, which is then sent on to other member airlines to reside in their respective passenger service systems.
Sources said, SIA is contacting all customers to let them know if they are affected. The airline said it will also review current procedures and take all necessary steps to improve data security. Sita said in a separate statement that it was hit by a highly sophisticated cyber-attack that affected certain data stored on its passenger service system servers. However, it had confirmed "the seriousness of the data security incident" on Feb 24.
