Data from Airlink International UAE leaked on multiple dark web forums

Cybersecurity researchers from Cyble have spotted a threat actor sharing leaked data of Airlink International UAE for free on two different platforms.

Cybersecurity researchers from Cyble have found a threat actor sharing leaked data of Airlink International UAE for free on two platforms on the dark web.

The availability of the data on the dark web could pose organizations to serious risk, threat actors could use this data to carry out multiple malicious attacks.

Cyble discovered the data leak as part of its daily monitoring.

Airlink International U.A.E. is a leading company for any travel and logistics requirements. It has more than than 200 employees with around $250 million in revenue.

The data leak is the result of a misconfigured server containing 60 directories with approximately 5,000 files each.

The data leak was first reported on May 30, 2020, the data have been posted online by the collective KelvinSecTeam.

“The files present accommodation reservations, airline tickets and other logistics services that the company provides on a global scale. In a quick inspection by sampling, it was possible to observe customers of different nationalities and services provided in Africa, Asia and Europe.” reported the media.

According to Cyble, now, another threat actor is spreading the same data on multiple dark web forums in an attempt to gain fame.

Leaked data includes 14 folders and 53,555 files divided into the following categories:

Passport scansFlight bookingsHotel bookingsEmail communications between Airlink International Group employees and customersInsurance policy for international travel

Cyble provides recommends the following recommendation to the organizations:

Configure server to prevent unauthorized access, directory listingReview old backup and unreferenced files for sensitive informationTest file permissionsEnumeration of infrastructure and application administrator interfacesConsider running scans and doing audits periodically to help detect future misconfigurations or missing patches

Pierluigi Paganini

(SecurityAffairs – hacking, Airlink International UAE)