LockBit ransomware operators leak 200GB of data belonging to Bangkok Airways

LockBit ransomware operators have breached Bangkok Airways, the airline confirmed it was the victim and discloses a data breach impacting its passengers.

Bangkok Airways, a regional airline based in Bangkok, discloses a data breach as a result of a ransomware attack orchestrated by the LockBit ransomware operators.

The ransomware gang had posted a message on their leak site claiming to have breached the airline and threatening to leak stolen data if the company will not pay the ransom.

LockBit claims to have stolen more than 200GB of data belonging to the company, the message published by the gang on its leak site highlights the poor security implemented by the company.

“We Have More Files (Extra +200GB) To Show. And Many More Things To Say… They said : “We protect our customers privacy” But with “P@ssw0rd” for all systems and domain admins”

The company discovered the security breach on August 23 and immediately launched an investigation, with the assistance of a cybersecurity team, to determine the extent of the incident. Bangkok Airways also reported the breach to the authorities.

“An initial investigation of the incident appeared to confirm that some of the personal data may have been accessed which are, passenger name, family name, nationality, gender, phone number, email, address, contact information, passport information, historical travel information, partial credit card information, and special meal information. The company however, confirms that the incident did not affect the company’s operational or aeronautical security systems.” reads a press release published by the company. “This incident has been reported to the Royal Thai police as well as providing notification to the relevant authorities. For primary prevention measures, the company highly recommends passengers to contact their bank or credit card provider and follow their advice and change any compromised passwords as soon as possible.”

The airline company said that the security breach did not impact Bangkok Airways’ operational or aeronautical security systems, but attackers may have had access to personal data belonging to passengers.

Exposed data include passenger full names, nationality, gender, phone numbers, email and physical addresses, passport info, historical travel data, partial credit card info, and special meal details.

Bangkok Airways warns its customers to be vigilant and be aware of any suspicious or unsolicited calls and/or emails, as the attacker may attempt to carry out malicious activities such as phishing attacks. 

LockBit is the same ransomware gang that stole 6TB of data from Accenture and demanded a $50 million ransom to stop the leak of the data.

The gang also hit another airline company, on August 23 LockBit operators published data stolen from Ethiopian airline on its leak site.

Bleeping Computer, who contacted the threat actors, reported that they claim to have access to info that could allow them to target Accenture’s customers.

“Although the hackers declined to name a victim, they claimed to have compromised an airport that was using Accenture software and encrypted its systems.” reported Bleeping Computer.

Follow me on Twitter: @securityaffairs and Facebook

Pierluigi Paganini

(SecurityAffairs – hacking, Bangkok Airways )