Air Europa suffers a major data breach with full credit card details exposed

This article is closed to new comments. Feel free to ask your question in the HfP forums.

• ThinkSquare says:

  12 Oct12 October 07:23

  I like the bit about not giving your name when you phoning your bank.

• Robert says:

  12 Oct12 October 07:29

  Data breaches seem to follow IAG carriers or airlines connected to them….perhaps another airline that hasn’t invested enough in their IT…..like BA!

• Chris W says:

  12 Oct12 October 07:37

  They weren’t exactly a world-class airline to start with.

• TimM says:

  12 Oct12 October 07:44

  Absolute data security requires a very unfashionable proof-based approach – formal specification, pre-conditions, post conditions then a worked proof before the start of coding. No one in any major software company is educated in this fashion, and likely never will be. Perhaps it is time to elevate computer science education beyond the ‘failed mathematician’ label.

  Current data security is a whole mish-mash of bought-in products with no formal verification individually nor in combination. Data breaches will inevitably become ever more prevalent. It is probably better to change identity and all payment methods every few seconds than to rely on the data security of the corporates.

  • Lady London says:

    12 Oct12 October 09:24

    IMV proper IT testing went out the window decades ago @TimM. I’ve even had a project leader from one of the Big Four try to get me removed as the interfacing client leader when I told them I would insist on testing what they were implementing properly to find any bugs before they got to the users.

    Apparently the standard of testing was only to verify narrow functionality could be said to have worked once so a box could be ticked that it had worked once without testing the functionality worked under more than one set of parameters.

    • TimM says:

      12 Oct12 October 11:56

      @Lady London, depressing, to say the least.

  • Bagoly says:

    12 Oct12 October 19:05

    I completely agree about formal specifications and proofs.
    Although there are two additional points which even boards should understand:
    1) effort can be drastically cut down by thinking in advance and eliminating a risk, rather than mitigating it. E.g. I looked at PCI DSS and went “too onerous” so send customers to Stripe with a Description+Currency+Amount request.
    2) even if you are 100% secure from one angle, there can be another – E.g. everything may be wonderfully encrypted, but an intercept attack is still a risk. And if a code injection gets through, it can invalidate almost everything else.

• Charles Martel says:

  12 Oct12 October 08:02

  Could this and the potential huge fine jeapordise the takeover deal?

  • Rob says:

    12 Oct12 October 08:39

    In this scenario IAG would insist that the sellers agree to pay.

• JandeW says:

  12 Oct12 October 08:04

  Judging by the fact that, for the last 6 months or so, BA (read IAG) has proved itself incapable of a) allowing me to access the BA Mobile App and then b) updating the data within the app, this display of data security incompetence and total ambivalence to its results by a sister IAG company, surprises me not one bit!

  • BA Flyer IHG Stayer says:

    12 Oct12 October 08:59

    Air Europa isn’t owned by IAG so it can’t be BAs “sister” or any other relative.

    • The Savage Squirrel says:

      12 Oct12 October 13:33

      Ugly stepsister?

• Mike says:

  12 Oct12 October 08:30

  At least they sent an email I guess, TAP didn’t bother and tried to hide it on their web site.

• Amelia Expat says:

  12 Oct12 October 08:38

  I work for a Bank, previously in fraud, and we hate it when companies deal with beaches like this (i.e. ‘we’ve been hacked so go and speak to your bank yourself’). The merchant (i.e. Air Euhopeless) should contact the Schemes with the card data (e.g. Visa, MasterCard, AMEX etc) who can activate some of their own fraud analytics which can involve identifying which merchants are being used for fraud spend. The schemes also divvy the cards up by Card Issuer (e.g. HSBC, Santander etc) and pass them directly over to the Compromised Cards Teams in those Issuer organisations who can either arm (enhanced monitor) or replace the cards. In a parallel universe, Air Europa would then be able to say “No need to contact your Card Issuer! [who might not be a bank, by the way]. We have already made them aware and they will be in contact with you. In the meantime, protective measures have been applied to your card, and you only need to call your card issuer if you notice any unrecognised transactions on your statement. Please monitor your statement carefully” etc. This way the card issuers’ phone lines remain available for people who really need to speak to them as opposed to literally everyone whose card data was stolen, and you actually lessen the inconvenience among all the victims rather than just talking about it.
  Also, I’m not sure how this breach has happened without breaches of PCIDSS compliance by AirEuropa. I’m no expert in that but pretty sure card data should be encrypted in transit and storage.

  • sayling says:

    12 Oct12 October 09:00

    This. This is how it should be done

  • memesweeper says:

    12 Oct12 October 10:18

    Absolutely. It would appear Air Europa *still* hasn’t hired an actual cybersecurity expert (or isn’t listening to them) 🙄

  • Roy says:

    12 Oct12 October 10:32

    There are ways this can happen without blatant PCIDSS violations such as storing cleartext card details, storing CVV data etc. A server compromise can allow attackers to inject JavaScript malware into the page that captures the card details as you enter them into your browser and sends them to the attacker. IIRC the BA hack was something like this.

    Of course, in that scenario the question would still remain as to whether that server compromise was due to a failure of other PCIDSS controls.

This article is closed to new comments. Feel free to ask your question in the HfP forums.