Image copyright Reuters Image caption Experts say the loss of password details could be "severe"

Air Canada's app has suffered a data breach resulting in the suspected loss of thousands of its customers' personal details.

The airline has warned that users who had entered their passport details into the product may have had that data stolen.

Experts warn that the theft of such information would pose a serious ID fraud risk.

The firm has also been criticised for its relatively weak password system.

Although it is not clear how the breach occurred, one cyber-security specialist highlighted that Air Canada's website still says account passwords should contain between six and 10 characters and that it only accepts letters and numbers, but no other symbols.

"Many users will choose short and easily guessable passwords," commented Amit Sethi, a security consultant at Synopsys.

"Moreover, users that want to use strong passwords cannot do so."

Image copyright Air Canada Image caption Air Canada's website still says no special characters are allowed when creating an account password

According to the Canadian government's own cyber-security advice, all passwords should "include at least one character that isn't a letter or number" and be a minimum length of eight characters.

The firm said it has adopted "improved password guidelines".

Its app now says that passwords should be at least 10 characters long and contain one symbol.

Account lock-outs

Air Canada said that it detected unusual login activity between 22 and 24 August and decided to lock down all 1.7 million of its accounts as a consequence.

It believes data has been stolen from about 20,000 of these, and has informed members of this group via email.

However, all customers will need to reset their logins to use the app again.

The airline says customers' credit card details were encrypted, so should not be at risk.

But basic profile data that could have been exposed includes names, email addresses and phone numbers.

In addition, it warned the following details may also have been copied if they had been provided:

passport number

passport country of issuance

passport expiration date

country of passport issuance

nationality

country of residence

birth date

The City of London's Action Fraud team told the BBC that the "consequences of having your passport information accessed can be severe".

It said banks, insurance firms and mobile phone providers were among businesses that request the data to set up accounts, but do not always require sight of the physical document.

Victims can face wrecked credit scores and bills, from which it can take months to extricate themselves.

In some cases, Action Fraud added, it is even possible to use the information to obtain genuine documents such as driving licences and new passports.

"The loss of passport data in this breach makes it unusual," commented Prof Alan Woodward, from the University of Surrey.

"Like driving licences, passports are considered government-issued ID and it is assumed that only the holder will know the contents.

"But we're at the point where so much sensitive data is being released via such breaches that we can no longer assume that mere knowledge of what is written in a passport is sufficient to verify ID online."

Air Canada has recommended that its customers "regularly review their financial transactions, be aware of any changes to their credit rating, and contact their financial services provider" if they become aware of unusual activity.</s>Air Canada has notified customers of a data breach involving the airline's mobile application which may have led to the exposure of passport details belonging to 20,000 customers.

On Wednesday, the Canadian airline posted a notice on its website informing customers of the data breach, which was detected between August 22 -- 24.

Air Canada says that "unusual login behavior" was detected within the Air Canada mobile app. Despite the company taking "immediate action" in blocking the attempt to compromise the system, it is believed approximately 20,000 customers may have had their data stolen.

While 20,000 customers represent only approximately one percent of the firm's full customer base, passport numbers have also been thrown into the mix.

Profile data, including names, email addresses, Aeroplan number, passport numbers, NEXUS numbers, Known Traveler numbers, genders, birthdates, nationalities, passport expiration dates, passport countries of issuance and countries of residence can all be added to the app. Any of this data may have been improperly accessed.

CNET: Equifax's data breach by the numbers: The full breakdown

However, Air Canada is keen to point out that the Canadian government says the risk of a third-party obtaining a passport in your name is "low" on the proviso that users still own their passport and have both ID and proof of citizenship.

"According to the website, the Government of Canada cannot issue a new passport to anyone based on only the information found in a passport," the company added.

No financial details are believed to be at risk and were stored with encryption in place.

"Your privacy and the protection of your data are extremely important to Air Canada," the airline said. "Our security is multi-layered, and we work with leading industry experts to continuously improve our practices as technology and security procedures evolve."

TechRepublic: A data breach may be more expensive than you think, thanks to these hidden costs

Affected customers are being informed directly and all Air Canada mobile app users have had their accounts locked due to a forced password reset out of caution.

See also: Defense Distributed now sells 3D gun blueprints online, 'pay what you want'

"Airlines are increasingly encouraging travelers to utilize apps to track flight information and access digital boarding passes -- but this convenience can introduce new cyber risks that these companies never had to worry about before," Setu Kulkarni, VP of corporate strategy at WhiteHat Security told ZDNet. "While Air Canada's B2B integration with the Aeroplan platform is extremely useful for business productivity, it has certainly fallen short of meeting security needs of the business."

The executive suggested that a vulnerability in the B2B integration may have been at fault and this could also indicate a wider security issue.

"The breach was through the mobile application, and it's very possible that the backend services used by the mobile app are the same ones the web app and other backend systems use -- which could imply a potentially wider-reaching breach," Kulkarni added.
• Meet the malware which hijacks your browser and redirects you to fake pages</s>Ellen is a Verdict staff writer and reporter. You can reach her at ellen.daniel@verdict.co.uk

Air Canada has revealed that a security breach, affecting 20,000 customers, may have left passport information vulnerable to cyber attackers.

The largest airline in Canada reported the breach on 28 August, and urged users of its mobile app to reset their accounts as a security precaution following “unusual login behaviour”. It has also locked all Air Canada mobile app accounts to protect customer data.

Of the 1.7 million Air Canada mobile app users, the airline has reported that approximately 1%, or 20,000 profiles, may potentially have been improperly accessed.

As well as users’ names, email addresses and telephone numbers, Air Canada has confirmed that more sensitive information, including passport numbers, may be included in the breach. Credit card information, however, is encrypted and therefore not at risk.

According to the BBC, the Air Canada data breach may have been caused by a weak password system. Air Canada’s mobile app only requires passwords to be between six and ten characters, and does not allow symbols, making passwords easy to guess. The airline has said that it has since implemented “improved password guidelines” designed to “further enhance security measures”.

In a statement, the airline said:

Air Canada data breach is the latest in a series of breaches

The Air Canada data breach is just one in a long line of similar cyber-attacks. Just last week, telecom company T-Mobile confirmed that it had suffered a security breach on its US servers, exposing the personal data of up to two million customers.

Earlier this month, Butlins, a UK holiday camp, also admitted that the details of 34,000 customers, including addresses and telephone numbers, may have been stolen.

This follows the news that data breach complaints made to the Information Commissioner’s Office have increased by 160% since the General Data Protection Regulation (GDPR) came into force in May.

The sheer number and scale of recent breaches calls the security practices of the companies involved into question. Last year, a report from Identity Theft Resource Center and CyberScout revealed that data breaches in the US hit a record high in 2017, increasing by 29% in the first half of the year.

Furthermore, a survey by software and cyber-security company OGL found that 51% of businesses thought they wouldn’t be able to cope with a data breach.

Commenting on the T-Mobile data breach, Chief Security Strategy Officer, SecureData Charl van der Walt, believes that the problem of data breaches could take years to untangle:

“No doubt the causes of this breach will be scrutinised in minute detail to determine whether, how and to what extent T-Mobile is responsible for this loss, and regulatory fines, SEC penalties and civil law suits may all follow. But none of this is likely to change the fundamental fact that billions of these kinds of records are being leaked to the Internet at a growing rate with all the implications for privacy, digital security and person safety that that brings. “Addressing the problem of personal data leaks will take years or decades even and will require political will and deep commitment from business, government, and the security industry.”</s>Air Canada has confirmed a data breach on its mobile app, which the airline said may affect 20,000 people — or 1 percent — of its 1.7 million app users.

The company said it had “detected unusual log-in behavior” occurring between August 22-24.

According to an email to customers, attackers may have accessed basic profile data, including names, email addresses and phone numbers — but also more sensitive data that users may have added to their profiles, including passport numbers and expiry date, passport country of issuance, NEXUS numbers for trusted travelers, gender, dates of birth, nationality and country of residence.

But credit card data was not accessed, the airline said.

It’s not known if there was a direct breach of Air Canada’s systems or if hackers attempted to reuse passwords from other sites that may have also been used on Air Canada’s mobile app.

When reached, an Air Canada spokesperson did not comment on the breach, referring only to a FAQ on the airline’s website.

Air Canada joins the ranks of other airlines that have admitted data breaches in recent months. Delta said earlier this year that customer data was stolen after a security lapse at one of its third-party customer support service vendors. And, last year Virgin admitted it a hacker broke into its internal network, prompting the company to force-reset staff passwords.</s>Air Canada’s app has suffered a data breach and thousands of customers are affected.

Air Canada says that personal data of 20,000 of its mobile app users may have been affected in a data breach. The airline said that it noticed “unusual login activity” between 22-24 August and “immediately took action”.

All 1.7m users of the app have been locked out until they update their passwords and have been emailed instructions on how to log in to the app and change passwords.

Air Canada is urging its customers to closely monitor their credit card activity and immediately contact their financial institutions if they notice anything out of the ordinary. It did note that credit card data is encrypted and therefore protected. Passport details may have been copied, including passport number, country of issuance, expiration date and birth date, among others.

The breach does not affect those users who have an account on aircanada.com.

Some app users have reported a glitchy process when trying to change their passwords, as well as delays in certain cases. The airline says the issues are due to a large volume of customers trying to change their passwords at the same time.

It is not yet clear what caused the breach.

Setu Kulkarni, vice president of corporate strategy at WhiteHat Security told Siliconrepublic.com that while convenient, airline apps can introduce an array of new cybersecurity problems that were previously not an issue.

Kulkarni added: “While Air Canada’s B2B integration with the Aeroplan platform [a travel loyalty scheme for frequent fliers] is extremely useful for business productivity, it has certainly fallen short of meeting security needs of the business.

“When the integration occurred, a security vulnerability in Air Canada likely began propagating to Aeroplan through the (likely API-based) connectivity.

The breach was through the mobile application, and it’s very possible that the backend services used by the mobile app are the same ones the web app and other backend systems use – which could imply a potentially wider-reaching breach.”Comprehensive security testing and training along with continuous assessment of production assets could make such massive breaches a thing of the past.”

Samuel Bakken, senior product marketing manager, OneSpan, said that the absence of strong, multifactor authentication integrated into the app may have been the source of the issue.

He added that there are other authentication methods available to developers: “Many vendors offer easy to use mobile development toolkits that makes it easy to natively integrate advanced biometric authentication into their apps.”</s>Although Air Canada says that a data breach discovered last week only affects 20,000 of its mobile app accounts – including passport details – it’s requiring all 1.7 million users to reset their passwords the next time they login.

Users will see a notice asking them to reset their password as a result of too many failed login attempts the next time they try to log in. In a notice, Air Canada notes that some customers may experience a delay when logging in due to the large volume of account resets.

“We detected unusual login behaviour with Air Canada’s mobile app between Aug. 22 – 24, 2018. We immediately took action to block these attempts and implemented additional protocols to protect against further unauthorized attempts. As an additional security precaution, we have locked all Air Canada mobile App accounts to protect our customers’ data,” the notice states. The airline is also contacting potentially affected customers directly.

Air Canada says credit card information and Aeroplan loyalty program passwords were not affected by the breach. But Aeroplan account numbers, as well as name, email address, and phone number information may have been at risk. For app users storing passport information, Nexus information, Known Traveler number, as well as birthdate and nationality details, that data is potentially at risk.

“If you stored your passport information on your profile, the Government of Canada’s passport website advises that the risk of a third party obtaining a passport in your name is low if you still have your passport, proof of citizenship and supporting identity documents. Also, according to the website, the Government of Canada cannot issue a new passport to anyone based on only the information found in a passport,” the notice states.</s>MONTREAL — Some 20,000 Air Canada customers woke up Wednesday to learn their personal information may have been compromised after a breach in the airline’s mobile app, which prompted a lock-down on all 1.7 million accounts until their passwords could be changed.

Air Canada said it detected unusual login activity between Aug. 22 and Aug. 24 and tried to block the hacking attempt, locking the app accounts as an additional measure, according to a notice on its website.

Mobile app users received an email Wednesday morning alerting them as to whether their account had been affected.

The app stores basic information including a user’s name, email and phone number.

Any credit card data is encrypted and would be protected from a breach, Air Canada said.

But Aeroplan numbers, passport numbers, birth dates, nationalities and countries of residence could have been accessed if users saved them in their account profile, the company said.

Air Canada declined to respond to questions, referring The Canadian Press to its website.

The risk of a third party obtaining a passport in someone else’s name is low if the user still has their passport and supporting documents, according to the federal government.

Users can reactivate their account along stricter password guidelines by following instructions emailed to them or prompts when logging in.

Some users reported problems with the process on social media, likely due to the volume of customers trying to unlock their account.

Air Canada advised anyone looking to access the app to keep trying.

In March, the airline said some customers who booked hotels through its former travel partner Orbitz may have had their personal data stolen.

Nearly 2,300 bookings through Air Canada hotel options could have been involved in a data breach of hundreds of thousands of records that Orbitz reported earlier this year, Air Canada said.

The Expedia-owned travel website operator, whose platform Air Canada no longer uses, disclosed on March 20 that hackers may have accessed personal information from about 880,000 payment cards in 2016.</s>Air Canada on Tuesday disclosed a data breach that exposed the personal information of around 20,000 of its mobile app users.

"We recently detected unusual login behavior with Air Canada's mobile app between Aug. 22-24, 2018," the company wrote in a notice to customers. "We immediately took action to block these attempts and implemented additional protocols to block further repeated unauthorized attempts."

The company said about 1 percent of the 1.7 million Air Canada mobile app user profiles—or 20,000 in total—"may potentially have been improperly accessed." The breach exposed users' names, email addresses, phone numbers, and any other information they have added to their profiles. That could include a user's passport number, passport expiration date, passport country of issuance and country of residence, Aeroplan number, NEXUS number, Known Traveler Number, gender, birthdate, and nationality.

The company said credit card information is protected. "Credit cards that are saved to your profile are encrypted and stored in compliance with security standards set by the payment card industry or PCI standards," the notice reads.

Air Canada is now notifying all potentially affected individuals via email.

"If you did not receive an email from Air Canada specifically advising you that your Air Canada mobile App account may have been improperly accessed, we are confident your account was unaffected during this period," the company wrote.

As a precaution, however, the company has locked all Air Canada mobile app accounts. All 1.7 million users will need to change their passwords "using improved password guidelines" to access their accounts.

"It is important to select a robust password as per our instructions when you reset your account," the company advised. "We recommend customers regularly review their financial transactions, be aware of any changes in their credit rating, and contact their financial services provider immediately if they become aware of any unusual or unauthorized transactions."</s>Aeroplan numbers, passport numbers, birth dates, and countries of residence could have been accessed

Some 20,000 Air Canada customers woke up Wednesday to learn their personal information may have been compromised after a breach in the airline’s mobile app, which prompted a lock-down on all 1.7 million accounts until their passwords could be changed.

Air Canada said it detected unusual login activity between Aug. 22 and Aug. 24 and tried to block the hacking attempt, locking the app accounts as an additional measure, according to a notice on its website.

Mobile app users received an email Wednesday morning alerting them as to whether their account had been affected.

The app stores basic information including a user’s name, email and phone number.

Any credit card data is encrypted and would be protected from a breach, Air Canada said.

But Aeroplan numbers, passport numbers, birth dates, nationalities and countries of residence could have been accessed if users saved them in their account profile, the company said.

Air Canada declined to respond to questions, referring The Canadian Press to its website.

The risk of a third party obtaining a passport in someone else’s name is low if the user still has their passport and supporting documents, according to the federal government.

Users can reactivate their account along stricter password guidelines by following instructions emailed to them or prompts when logging in.

Some users reported problems with the process on social media, likely due to the volume of customers trying to unlock their account.

Air Canada advised anyone looking to access the app to keep trying.

Like us on Facebook and follow us on Twitter</s>The personal information of about 20,000 Air Canada customers may have been compromised after a breach in the airline's mobile app and officials have locked down all user accounts until passwords can be changed.

The airline says unusual login activity was detected between August 22nd and 24th, which prompted it to lock down about 1.7 million accounts.

Air Canada posted a notice to app users on its website on Wednesday asking people to reset their passwords as a precaution.

Officials say immediate action was taken to block the hacking attempt and that ‘additional protocols to protect against further unauthorized attempts’ were implemented following the data breach.

Air Canada says credit card information is protected by encryption but that information included in about 20,000 user profiles may have been improperly accessed.

On August 29, the airline started sending emails to customers who may have been impacted with instructions on how to reset their accounts.

The breach affected about one percent of the app’s users and some passengers at the Calgary Airport said they are concerned.

“This is definitely scary when you have your personal info on those apps and put all your passport information or if you’re travelling internationally or social security or anything like that, it’s kind of scary to think about because there’s a lot of fraud that goes on these days,” said Raj Desai.

“We always have concerns, we don’t use apps a lot because of that reason, we’re concerned about privacy,” said Kevin Bailey.

The airline says some users may experience delays while trying to change passwords and suggests that people wait a few hours and try again.

For more information on how to reset accounts, click HERE.
Air Canada reports a data breach in which passport information was accessed.