Questions have been raised about Cathay Pacific’s incident response after new details emerged about the world’s biggest airline data breach.
The Hong Kong carrier had originally claimed last month that it “discovered unauthorized access” to data on 9.4 million passengers and “took immediate action to investigate and contain the event.” Reports at the time suggested that the firm first found evidence of the activity in March and confirmed data had been accessed two months later.
That would have been bad enough, but in a new filing to the Hong Kong legislature (LegCo) this week the airline admitted that after discovering the initial suspicious activity it “was subject to further attacks which were at their most intense in March, April and May but continued thereafter.”
“These ongoing attacks meant that internal and external IT security resources had to remain focused on containment and prevention,” it continued. “[They] also expanded the scope of potentially accessed data, making the challenge of understanding it more lengthy and complex…”
Under local laws, Cathay wasn’t mandated to notify the authorities immediately of a breach, but the fact that it couldn’t work out until August which passenger data had been accessed or exfiltrated will raise some eyebrows.
The SAR’s privacy commissioner said last week that it was launching a compliance investigation into the firm’s handling of the breach, and new data protection laws may be rolled out in the city-state.
The airline is said to be working with 27 regulators in 15 jurisdictions following the incident, although it could escape GDPR investigation given the initial intrusion was discovered in March.
The airline's assurance that there’s been no evidence of misuse of the stolen data is meaningless, according to High-Tech Bridge CEO, Ilia Kolochenko.
“Worse, it may mean that someone very smart is exploiting the data in a non-trivial way, and probably very detrimental for the victims. Moreover, the stolen data can appear for sale on the black market at any time,” he added.
“Taking into consideration the gravity of the breach, customers of Cathay will likely have no reliable recourse apart from promptly changing all their credit cards and IDs. Cathay may face numerous class actions and individual lawsuits from disgruntled customers, in parallel with severe monetary sanctions imposed by regulators from different countries.”
One UK law firm is already preparing a class action suit.