Ahead of what is expected to be a busy holiday travel weekend in the U.S., multiple airlines reported experiencing cyber attacks to their IT systems.
In North America, Hawaiian Airlines and WestJet have confirmed that they both experienced cyber attacks in the past week. The Federal Aviation Administration said in a statement on June 26 there had been no impact to safety with the Hawaiian Airlines attack. WestJet said that it launched an investigation into the attack.
And Tuesday, Australian flag carrier Qantas said that it experienced a cyber attack that breached a third-party customer service platform. Qantas said that the breach has since been contained.
The FBI said in a statement on June 28 that a cybercriminal group called Scattered Spider had started targeting the airline sector.
“Once inside, Scattered Spider actors steal sensitive data for extortion and often deploy ransomware,” the FBI said.
The airlines that confirmed cyber attacks have not said whether ransomware was used or if extortion was involved.
Here’s what to know about the cyber attacks:
What Is Scattered Spider?
Scattered Spider is a hacking group that is mostly based in the U.S. and U.K. The group received attention in 2023 when it was linked to a set of mulit-million dollar hacks at Caesars Entertainment and MGM Resorts.
At the time, the two companies confirmed that Social Security numbers and customers’ driver license numbers linked to their loyalty accounts had been stolen.
Scattered Spider was also linked to a spate of cyber attacks on insurance company Aflac, potentially stealing Social Security numbers, insurance claims, and health information. The cybercriminal group also targeted the retail sector in May.
The FBI said Scattered Spider often relies on “social engineering,” a tactic in which criminals impersonate employees or help desks to gain access to third-IT systems.
“They target large corporations and their third-party IT providers, which means anyone in the airline ecosystem, including trusted vendors and contractors, could be at risk,” the agency said.
Why Are Airlines Being Targeted?
Like many other industries, airlines have a lot of valuable customer information on file, said John Rose, the chief risk officer of ALTOUR, a business travel technology company.
“They want to know who you are and how to maybe use that to get into your other systems,” he said. “But they also want access to your payment information. Because they can steal your credit cards, etc.”
In the case of Scattered Spider, the cybercriminal group tends to focus on one sector at a time for a few weeks, said Charles Carmakal, the chief technology officer of Google-owned cybersecurity firm Mandiant, in a LinkedIn post on June 28.
How Are Airlines Responding to the Attacks?
Qantas said it was currently contacting customers about the incident and is “putting additional security measures in place to further restrict access and strengthen system monitoring and detection.”
The carrier added that it notified the Australian Cyber Security Centre, the Office of the Australian Information Commissioner, and the Federal Police. Qantas said it would support these agencies in an investigation.
Qantas also created a dedicated customer support line and said it would continue to share updates on social media and on its website.
Alaska Air Group, the parent company of Hawaiian Airlines, said in a securities filing on June 27 that it “immediately took steps to safeguard Hawaiian’s operations and systems” and “engaged the relevant authorities and experts to assist in our investigation and ongoing remediation efforts.”
WestJet said it was working to safeguard its digital operations and support specialized teams working to resolve the incident. WestJet added that it is working with law enforcement on an investigation into the breach.
Mandiant, which has been helping airlines with recovery, also published a set of guidelines for protecting IT systems against Scattered Spider attacks, according to CNN.
Airlines Sector Stock Index Performance Year-to-Date
What am I looking at? The performance of airline sector stocks within the ST200. The index includes companies publicly traded across global markets including network carriers, low-cost carriers, and other related companies.
The Skift Travel 200 (ST200) combines the financial performance of nearly 200 travel companies worth more than a trillion dollars into a single number. See more airlines sector financial performance.
Read the full methodology behind the Skift Travel 200.
Rephrase in a different way as if you were a native American speaker as a content creation expert and do not talk about yourself or your experience in the text and do not show yourself as an artificial intelligence who wrote and fill the bullet point in the topic and speak the heart of the topic itself and dont take date of blog in ther first and dont take text like box of newsliter subscribe on post from content and romove all linke insert in content and and remove all affiliate disclosure phrases on content like this “This post may contain Amazon or other affiliate links that allow us to earn a small commission at no extra cost to you. Please see our Disclosure Policy for more info” and “#” put in its place bullet point, and romove name of the web site or his links we are take a content from our new creation, and don’t publish clone new content more than just one time
