Air India data breach highlights concerns around third-party risk and supply-chain security

A cyberattack on systems at airline data service provider SITA has resulted in the leaking of personal data of 4.5 million passengers worldwide, Air India told its customers earlier this month. The data breach highlights the risk posed to airlines and their customers of third-party IT systems.

SITA first notified the airline of the breach on February 25, 2021, but it wasn’t until March 19 that Air India disclosed it on its website. And while Air India received further details of the extent of the breach on March 25 and April 5, it waited until May 15 before passing them on to its customers.

The compromised dataset comprises passenger information collected between August 26, 2011 and February 3, 2021. It includes names, contact information, dates of birth, passport details, ticket information, and credit card details—although the Card Verification Values (CVVs) of the compromised cards are not stored by the system, Air India said.

To read this article in full, please click here