Airlines: A High Threat For Data Breaches
(Image Source: Marcelo Solis)
Air Europa, Spain’s third-largest airline, has found itself in the unwanted spotlight adding yet another chapter to cyber security woes. This Spanish airline caters to passengers originating from all around Europe, North America, the Caribbean, Morocco and Tunisia. The Air Europa Security Breach is of particular significance, as it is currently undergoing acquisition by the International Consolidated Airlines Group, the parent company of British Airways.
Air Europa’s Response To Data Breach
Reuters reported the airline company has notified affected individuals and warned them of potential risks. Their recommended course of action? Cancel your cards immediately - “to prevent possible fraudulent use of your information.”
Frustrated customers have posted emails received from Air Europa. These emails state in both Spanish and English, "we inform you that a cybersecurity incident was recently detected in one of our systems consisting of possible unauthorized access to the following:
The number of the bank card ending in
The expiration date of that card
The CVV of the card"
As of now, the airline has not disclosed the extent of the Data Breach, the number of impacted customers, or the potential financial repercussions resulting from this security incident.
In a statement, a spokesperson emphasized to Airport Technology:
“Our IT team confirmed the existence of a cybersecurity problem that would have affected the payment gateway used to manage purchases through our website. This fraudulent alteration of the payment process would have allowed the leak of credit card data.
There is no evidence that this leak was ultimately used to commit any fraud. The detection and rapid intervention of the team for the deployment of the protocol established in our Response Plan has allowed us to block the security breach and prevent the leakage of new data.”
Air Europa's History
Unfortunately, this is not Air Europa's first brush with a data breach. In 2021, the news was made public of a €600,000 fine by the Spanish Data Protection Agency (AEPD) for violating EU General Data Protection Regulation (GDPR) only available in Spanish, here. The fine encompasses two specific irregularities. The first violation, resulting in a 500,000 euro penalty, is associated with the mishandling of affected individuals' personal data.
"The security incident has involved unauthorized access to bank card information, numbering, expiration date and CVV that could have been used for the commission of fraudulent operations. Although all those identified were canceled before it is clear that there has been any harm to the interested parties," the resolution explains.
The second fine, totaling 100,000 euros, is related for a delay to report any security breach to the Spanish Data Protection Agency within 72 hours of becoming aware of it.
Air Europa Aftermath: Signifiant Outcomes To Anticipate
1. Increased Security Budgets and IT Investments
Airlines will acknowledge the urgency of strengthening their cybersecurity infrastructure in order to cover the growing security costs of complex IT environments. It's often said that "prevention is better than cure." While this data breach emphasizes multiple security areas that demand focus and proactive actions, companies must find solutions to address the increasing costs associated with IT, which are necessary for innovation and cybersecurity, support IT backbone modernization and lay the groundwork for innovation.
2. Legal Involvement and Regulatory Scrutiny
With sensitive credit card data exposed and customers affected, legal authorities are likely to take a keen interest with regulators knocking on the door, demanding answers and compliance with data protection laws. One side effect will have legal teams undoubtedly play pivotal roles, from timely reporting to customer communication, companies will find themselves navigating stringent obligations, scrutiny and compliance.
3. Anticipating More Regulations
In the aftermath, we could see an industry-wide response in the form of new regulations. As airlines face the escalating threat of cyberattacks, governments and international bodies may introduce stricter data protection laws. Compliance with these regulations will entail increased complexities and expenses for airlines, emphasizing the need for an increase in security budget and data protection protocols.
4. Repercussions Beyond Air Europa
The fallout from this data breach isn't limited to Air Europa alone. Airlines across the globe may face a backlash from passengers who now worry about the safety of their personal information when booking flights. This negative sentiment can extend far beyond the airline that suffered the breach, potentially impacting the entire industry. Trust, once lost, is challenging to regain, and passengers may scrutinize airlines more closely before sharing their data.
5. The Impact on Acquisition by IAG
Air Europa is currently in the process of being acquired by the International Airline Group (IAG). The data breach couldn't have occurred at a worse time. The incident is sure to affect the acquisition process, introducing a level of uncertainty and potentially leading to negotiations and considerations regarding security and data protection. It's essential for IAG to address this incident and its implications during the acquisition.
6. Financial Ramifications
Finally, given the increased severity of this recent breach, financial penalties could be substantially higher. Airline reputation and financial stability will be put to the test from response to consequences such as this.
Security In The Sky
When companies experience data breaches, it's not just the immediate losses that matter. By its nature, such cyberattacks cause operational disruption, reliability and influencing passenger dissatisfaction and loyalty. The wealth of sensitive data that cybercriminals acquire is a rising threat for data breaches and hackers are seemingly relentless in their pursuit.
Airlines play a vital role in public infrastructure and society, making them prime targets and the industry is a behemoth in the arena. It’s this very allure that beckons threat actors into its sphere, each with their unique motivations. To confront the difficulties arising from digital advancements, airline leaders must prioritize ensuring IT Security reliability, handling Cyber Security Risks, investing in tools and technologies, alongside various other initiatives.
As always, let us know your thoughts below.
Sources: Air Europa Official Website, Reuters, Airport Technology, Spanish Data Protection Agency (AEPD), International Airline Group (IAG), Head For Points
Contact Us Today
Learn more about Superuser OÜ by following us on LinkedIn.
Have a question? Find the following resources on our Services Page for other enquires, contact us.
Stay up-to-date! Register your interest for upcoming new products and services launching soon.
