Cathay Pacific hit with £500,000 fine for customer data breach

International airline Cathay Pacific has been issued with a £500,000 fine for failing to secure the personal data of its customers.

The Information Commissioner’s Office (ICO) said that, between October 2014 and May 2018 Cathay Pacific’s computer systems lacked appropriate security measures which led to customers’ personal details being exposed, 111,578 of whom were from the UK, and around 9.4 million more worldwide. The airline’s failure to secure its systems resulted in the unauthorised access to their passengers’ personal details including: names, passport and identity details, dates of birth, postal and email addresses, phone numbers and historical travel information, the ICO said, issuing the fine.

An investigation by the data protection authority found ‘a catalogue of errors’ in how the airline handled cybersecurity which resulted in the breach – which had been ongoing since at least October 2014 – not being uncovered and disclosed until May 2018.

The ICO said the attack was able to take place because back-ups were not password protected or encrypted, internet-facing servers were left unpatched despite a known vulnerability, the use of an unsupported operating system and inadequate anti-virus protection.

A lack of a software patching management strategy and users being able to remotely access systems without any sort of multi-factor authentication have also been criticised.

SEE: A winning strategy for cybersecurity (ZDNet special report) | Download the report as a PDF (TechRepublic)

Cathay Pacific only became aware of suspicious activity in March 2018 – three and a half years after the initial breach – after the database became victim of a brute-force attack as hackers tried to access additional areas by attempting to guess passwords.

Following this, a cybersecurity company was brought in to investigate the attack and the incident was referred to the ICO.

“People rightly expect when they provide their personal details to a company, that those details will be kept secure to ensure they are protected from any potential harm or fraud. That simply was not the case here,” said Steve Eckersley, ICO director of investigations.

“This breach was particularly concerning given the number of basic security inadequacies across Cathay Pacific’s system, which gave easy access to the hackers. The multiple serious deficiencies we found fell well below the standard expected,” he added.

As a result of the failures, the ICO has issued a Cathay Pacific with a fine of £500,000 – the maximum figure possible under the Data Protection Act 1998.

“The company would once again like to express its regret, and to sincerely apologise for this incident,” said a statement from Cathay Pacific.

“Substantial amounts have been spent on IT infrastructure and security over the past three years and investment in these areas will continue,” the airline added.

The Cathay Pacific data breach occurred before GDPR came into force in May 2018 which introduced significantly higher financial penalties for security breaches.

READ MORE ON CYBERSECURITY

READ MORE HERE