The intruders had been inside Cathay Pacific’s systems since at least 15 October 2014. The airline did not find them until May 2018, when it noticed a brute force attack on its Active Directory database.
Now the UK’s Information Commissioner’s Office (ICO) has fined the Hong Kong carrier £500,000 for “a number of basic security inadequacies”. The hack exposed the data of 9.4 million people worldwide, 111,578 of them in the UK. Pay by 12 March 2020 and the ICO will take 20 percent off, bringing the bill to £400,000.
What the attackers took
Cathay admitted the breach in October 2018. Passport details, dates of birth, nationalities, and postal and email addresses were among the records taken, along with phone numbers, frequent flier numbers and past travel histories.
The ICO’s investigation turned up two separate groups of attackers. One of them planted password-stealing malware and used the credentials it harvested to get into administrator systems.
The failures
The regulator listed what the airline had left undone. Database backups holding personal data were not encrypted. An internet-facing server had never been patched against a vulnerability that had been public for more than 10 years. Servers that handled sensitive data were running operating systems the vendor no longer supported.
Then there was the VPN. Some 41,000 users could get in with nothing but a username and password. “If Cathay Pacific had required MFA for every user, the attackers would not have been able to use the stolen credentials to access the VPN and the data breach would have been avoided,” the ICO said.
Cathay began rolling out multi-factor authentication to all users in September 2018, after the attackers had been found.
Five months of silence
The airline told the ICO about the breach on 25 October 2018, five months after it identified the attack. It said it had needed several months to analyse the data and understand the impact. Critics said that was too long, and the share price dropped.
Cathay is not the only airline in the regulator’s sights. British Airways was facing a £183 million ICO fine over a separate hack in which hackers harvested travellers’ data.
