SpiceJet Database Breach Exposed Details of Over 1.2 Million Passengers: Report

The SpiceJet breach was by a security researcher who is not being named, as they likely violated US computer hacking laws.

By Abhinav Lal | Updated: 30 January 2020 22:45 IST

SpiceJet Database Breach Exposed Details of Over 1.2 Million Passengers: Report

Photo Credit: Facebook/ SpiceJet

SpiceJet has provided a statement in response but has not confirmed the breach

Highlights

SpiceJet confirmed the security lapse to TechCrunch
It's uncertain whether the exposed passenger data was leaked
SpiceJet said to fix the breach after being contacted by CERT-In

SpiceJet was reportedly affected by a security flaw that exposed private details of more than 1.2 million passengers, including flight information. The information is said to have been found in an unencrypted database file after a security researcher gained access to a SpiceJet system by brute forcing the password. For now, details about the hack remain scarce, and the low-cost Indian airline has not revealed much in the boilerplate statement it provided in response to the report.

As reported by TechCrunch, the breach was by a security researcher who the publication is not naming, as they likely violated US computer hacking laws. The report elaborates to claim the researcher gained access to one of SpiceJet's systems by brute-forcing what's being termed as an "easily-guessable password." The system contained an unencrypted backup file with private details of over 1.2 million passengers, as of last month, including a rolling month's worth details such as name, phone number, email address, date of birth, and flight information.

The report adds the researcher had described their breach as "ethical hacking", and had contacted SpiceJet, but never received a "meaningful response" from the airline. It was only after the Ministry of Electronics and Information Technology's (MeitY) Indian Computer Emergency Response Team (CERT-In) was notified, independently confirmed the researcher's findings, and then alerted SpiceJet, that the breach was fixed.

Gadgets 360 reached out to SpiceJet spokesperson to comment on the security flaw. With the researcher themselves being reported to breach the system and gaining access to the database, the security lapse could perhaps be better termed as a vulnerability than a breach itself. It remains uncertain whether the data was leaked, or the 'ethical hackers' ensured that the database didn't get into the wrong hands, and responsibly saw that the issue was fixed.

We received a statement from a SpiceJet in response to our query, stating there had been no breach, "There was data breach in any of SpiceJet's servers. At SpiceJet, safety and security of our fliers' data is sacrosanct. Our systems are fully capable and always up to date to secure the fliers' data which is a continuous process. We undertake every possible measure to safeguard and protect this data and ensure that the privacy is maintained at the highest and safest level."

Editor's note: A previous version of this article stated that SpiceJet has confirmed to TechCrunch that the security lapse took place. The publication has since modified the article to remove all mentions of the confirmation, and we've made changes to reflect this upon clarification from SpiceJet.

Comments

For the latest tech news and reviews, follow Gadgets 360 on X, Facebook, WhatsApp, Threads and Google News. For the latest videos on gadgets and tech, subscribe to our YouTube channel. If you want to know everything about top influencers, follow our in-house Who'sThat360 on Instagram and YouTube.