Air Canada says the personal information for about 20,000 customers "may potentially have been improperly accessed" via a breach in its mobile app, so the company has locked down all 1.7 million accounts as a precaution until customers change their passwords. The airline told customers in an email that it "recently detected unusual log‑in behaviour with Air Canada's mobile App between Aug. 22‑24, 2018." The company estimates about one per cent of the 1.7 million people who use the app may have been compromised. The app stores basic information such as a user's name, email address and telephone number, all of which could have been improperly accessed. Any credit card information on file would have been encrypted and as such protected, the company says. But additional data such as a customer's Aeroplan number, passport number, Nexus number, known traveller number, gender, birth date, nationality, passport expiration date, passport country of issuance and country of residence could have been accessed, if users had them saved in their profile on the app. As long as app users still have a valid passport and other pieces of supporting documentation, the government says the risk of someone filing for and receiving a new passport in their names is low. Air Canada said it hasn't detected any improper log-in activity since last Friday, and it is in the process of contacting the 20,000 people directly affected. In the meantime, the company has locked down all mobile app accounts and is instructing users to reset their passwords. But many users on social media reported having difficulties doing so, likely due to the volume of people attempting to log on. The company advises anyone looking to get into the app to keep trying. Hello, we're aware of this issue. We suggest trying again, some users have advised us that they were successful after a few tries. /Quanisha —@AirCanada Chester Wisniewski, principal research scientist at cybersecurity firm Sophos says any stolen information isn't likely to be overly problematic, but it does raise more concerning questions about practices behind the scenes. "You never want someone to know your name, your birthday and your passport," he said. He says he thinks its unlikely that the company was targeted by hackers, but rather was simply caught off-guard by an enterprising cybercriminal. "I suspect hackers stumbled across a bug in the API," he says, referring to the acronym for the application programming interface which is how the app communicates with Air Canada's servers on the back end. "I don't think they were targeting Air Canada or they were intent on stealing specific info, there's a lot of hackers who are just scrolling the internet looking for doors that are ajar," he said. "If they find a door that's open they start monkeying around." He's concerned that the company has advised all customers — even those who's information wasn't accessed — to change their passwords. Because it's limited to only eight characters, "their password policy was rather antiquated which suggests they weren't doing it right to begin with," he said. "If you stored them correctly you wouldn't do that."<doc-sep>Although it is not clear how the breach occurred, one cyber-security specialist highlighted that Air Canada's website still says account passwords should contain between six and 10 characters and that it only accepts letters and numbers, but no other symbols.<doc-sep>Send this page to someone via email Air Canada says personal information of 20,000 of its mobile app users may have been affected by a data breach. In a news release, the airline explained that it noticed “unusual login activity” between Aug. 22-24 and “immediately took action.” READ MORE: Canadian businesses aren’t guarding your private information as carefully as they should be, survey says All users of the app — about 1.7 million customers — have been locked out of their accounts until they update their passwords. Users have also been emailed instructions on how to log in to the app and change passwords. READ MORE: Canadians say they are ready to ditch passwords for facial, fingerprint recognition WATCH: Air Canada says 20,000 out of its 1.7 million mobile app users may have had their personal information compromised. As Reid Fiest reports, cybersecurity experts say it’s a lesson not to enter valuable personal information into apps. 1:35 Major data breach at Air Canada affects millions Major data breach at Air Canada affects millions – Aug 29, 2018 The app stores names and contact information, which may have been accessed. Story continues below advertisement It also may hold information such as passport and NEXUS card numbers, gender, birth date, nationality and credit card numbers. LISTEN: Tom Keenan, University of Calgary professor and author of ‘Technocreep,’ explains why passwords are quickly becoming outdated In the coming days, Air Canada is urging customers to monitor their credit card activity and immediately contact their financial institutions if they notice anything unusual. However, the company noted that credit card information is encrypted and therefore protected. WATCH: Father of passwords regrets past advice 1:23 Father of passwords regrets past advice Father of passwords regrets past advice – Aug 10, 2017 While Aeroplan passwords are not stored on the Air Canada app, it is also asking users to track activity out of precaution. Story continues below advertisement The federal government explains on its website that the risk of someone unlawfully obtaining a passport under someone else’s name is low, because they need to provide other proofs of identity. Air Canada added that the breach does not affect those who have an account on aircanada.com. Customers hitting glitches Several app users trying to update their login information Wednesday reported delays and glitches in the process. @AirCanada ever considered IT isn’t your thing? Air Canada: change your pw, we’ve had a breach Me: tries to change pw but can’t because website crashes AC: we see suspicious activity on your account and deactivated it. Please change pw Me: clicks link. Website crashes. FML — Rohit Puri (@rpuri) August 29, 2018 Customers logging on for other purposes also hit troubles. Impossible to book flights right now on @AirCanada website. What is happening?? Receiving error messages and then complete page stoppage after clicking purchase and ending with a blank white screen. Fix please #AirCanada — Laurel (@thelaurelwreath) August 29, 2018 Air Canada explained on Twitter that the problems were caused by “high volumes” of customers trying to change passwords at once. Story continues below advertisement We’re confirming Air Canada App users need to reset their passwords. Due to high volumes some customers may be experiencing delays in doing this. Customer information is protected. Thank you for your patience. More information for AC App users is here: https://t.co/rLODRWM77B — Air Canada (@AirCanada) August 29, 2018 “We ask customers to be patient and assure them their data is protected and not accessible to unauthorized users,” the airline said in a statement. “We apologize for the delay. Please wait several hours and try again.” WATCH: Air Canada is just latest major company to get hit by a security breach. So how vulnerable is your information in the hands of all these corporations collecting it? Global National’s Robin Gill talks to technology expert Graham Williams of GetConnected for analysis. 3:05 How vulnerable is your personal information? How vulnerable is your personal information? – Aug 29, 2018<doc-sep>
MONTREAL -- Some 20,000 Air Canada customers woke up Wednesday to learn their personal information may have been compromised after a breach in the airline's mobile app that prompted a lockdown on all 1.7 million accounts until their passwords could be changed. Air Canada said it detected unusual login activity between Aug. 22 and Aug. 24 and tried to block the hacking attempt, locking the app accounts as an additional measure, according to a notice on its website. Mobile app users also received an email alerting them as to whether their account had been affected. The app stores basic information including a user's name, email and phone number. Any credit card data is encrypted and would be protected from a breach, Air Canada said. But Aeroplan numbers, passport numbers, birth dates, nationalities and countries of residence could have been accessed if users saved them in their account profile, the company said. "Some data, such as names or emails, may have been visible if an unauthorized user was able to gain access to an account," spokeswoman Isabelle Arthur said in an email. The risk of a third party obtaining a passport in someone else's name is low if the user still has their passport and supporting documents, according to the federal government. Users can reactivate their account along stricter password guidelines by following instructions emailed to them or prompts when logging in. Some users reported problems with the process on social media, likely due to the volume of customers trying to unlock their account. Air Canada advised anyone looking to access the app to keep trying. In March, the airline said some customers who booked hotels through its former travel partner Orbitz may have had their personal data stolen. Nearly 2,300 bookings through Air Canada hotel options could have been involved in a data breach of hundreds of thousands of records that Orbitz reported earlier this year, Air Canada said. The Expedia-owned travel website operator, whose platform Air Canada no longer uses, disclosed on March 20 that hackers may have accessed personal information from about 880,000 payment cards in 2016.