Malaysian carrier AirAsia has supposedly become victim of a data breach that released the information of millions of people.

According to cybersecurity researcher Soufiane Tahiri in a post on Twitter, AirAsia fell victim to a ransomware attack which saw hackers leak data belonging to around five million customers.

Personal information belonging to all AirAsia staff was also compromised in the ransomware attack, reports claim.

The cybercrime group Daixin Team leaked samples on November 11 and 12. The threat actors informed DataBreaches.net of what they had obtained in the AirAsia data breach.

DataBreaches said it has been provided with two .csv files, which the threat actors also sent to AirAsia Group, one of which contained information on named passengers.

The second included the information of all employees of the company and held numerous fields including names, dates of birth, countries of birth, locations, employment start dates, and security questions and answers.

A spokesperson from Daixin Team told DataBreaches that the airline had responded to the attack, asking Daixin’s negotiator for an example of the data, and after receiving the sample, “asked in great detail how we would delete their data in case of payment”.

According to Daixin, AirAsia reportedly did not try to negotiate the amount, indicating that there was never any intention of paying a ransom for the data. “Usually everyone wants to negotiate a smaller amount,” the spokesperson said.

The spokesperson surprisingly added that, due to poor organisation on AirAsia Group’s network, the company was spared from further attacks. Due to the chaotic state of the AirAsia network the group was unwilling to repeat the attack.

Asking whether the poor organisation really spared the airline, Daixin said: “Yes, it helped them. The internal network was configured without any rules and as a result worked very poorly.”

The spokesperson continued, saying that the hacking-group would still leak the passenger and employee data on their dedicated leak site, and make information about the network available privately and freely on hacker forums. So far, AirAsia has not replied to requests for comment.

AirAsia Group is allegedly hit by Daixin ransomware group 5M UNIQUE Passengers personal data, All employees personal data leaked@ransomwaremap pic.twitter.com/M9bg22S5QW

— Soufiane Tahiri (@S0ufi4n3) November 20, 2022

Commenting on the AirAsia ransomware attack, Julia O’Toole, CEO of MyCena Security Solutions, said that such massive data breaches are becoming a daily occurrence.

“Whether the attackers continue leaking the data, or if AirAsia decides to pay the demand is yet to be seen, but it will be customers and employees that get caught directly in the firing line,” she said.

O’Toole continued: “It’s not clear how attackers got into AirAsia system’s yet, but with employee credentials being used to execute over 82% of today’s cyberattacks, they will probably have played a part. This means to harden systems against breaches and ransomware, organisations must do more to protect their employees’ access credentials.

“One way to protect against breaches is by deploying access encryption where employee passwords are encrypted from end to end so they never know them. This means credentials can no longer be stolen or phished from users.

“Using encryption also places control back in the hands of enterprises. For the first time since digitisation started, they are able to control their network access rather than let employees make their own passwords, over which they have no control or visibility.”

Recommended

• Technical solutions with patients at the heart: CogniHealth takes on FND
• Qatar World Cup | Top players among most breached passwords
• Poor digital connectivity hampering electric vehicle charger rollout

The cyber-group Daixin has recently been the subject of an advisory from the US cybersecurity and intelligence agencies, which warned of attacks mainly aimed at the healthcare sector.

O’Toole continued: “Organisations must begin to realise that they are responsible for their data and have a duty to keep it safe. However, by allowing employees to create their own passwords and passkeys to access critical data, organisations are losing that control.

“No organisation ever allows employees to make their owns keys to access a physical office, yet they allow employees to create their digital keys to access their data, which is undoubtedly their most valuable asset today. This needs to change.”

Get the latest news from DIGIT direct to your inbox

Our newsletter covers the latest technology and IT news from Scotland and beyond, as well as in-depth features and exclusive interviews with leading figures and rising stars.

To subscribe, click here.