A data breach has hit one of India’s largest privately-held carriers, SpiceJet, affecting 1.2 million passengers in the country. Security researchers who first revealed the data breach told TechCrunch that they gained access to the carrier’s systems by brute-forcing the system’s easily guessable password.
In a statement, SpiceJet said: “At SpiceJet, safety and security of our fliers’ data is sacrosanct. Our systems are fully capable and always up to date to secure the fliers’ data which is a continuous process. We undertake every possible measure to safeguard and protect this data and ensure that the privacy is maintained at the highest and safest level”.
The private information of more than 1.2 million passengers were contained on an unencrypted database backup file of SpiceJet’s systems, according to the report. The details that the security researchers got access to as part of what they described as their “ethical hacking” efforts included the passenger’s name, their phone number, email address and their date of birth.
According to the security researchers, the database was easily accessible to everyone who knew where to look. Despite alerting SpiceJet about the data base, the researchers said they did not receive a meaningful response from the carrier. This led them to alert the Indian Computer Emergency Response Team (CERT-In). The aviation major, however, did not confirm CERT-In’s findings.
Watch Video: Best non-Chinese smartphones in India
Just last month, Facebook faced yet another data leak before the year’s end. The new leak compromised the details of over 267 million users. This time, the leak had Facebook user’s IDs, phone numbers and names. The data breach mostly affected people residing in the US.
Written with inputs from IANS