In a statement that was reported by Reuters, Spanish airline Air Europa, the country’s third-largest airline, warned customers on Monday to cancel their credit cards after attackers accessed their card information in a recent data breach.
“We have secured our systems, guaranteeing the correct functioning of the service. Additionally, we have made the due notifications to the competent authorities and necessary entities (AEPD, INCIBE, banks, etc.).”
The credit card details exposed in the breach include card numbers, expiration dates, and the 3-digit CVV code. Air Europa also warned affected customers to ask their banks to cancel their cards.
Two years ago, in March 2021, the Spanish Data Protection Agency fined the airline €600,000 for violations of the EU’s General Data Protection Regulation and for notifying the privacy watchdog of a data breach more than 40 days later. The attackers gained access to 1,500,000 data records.
The company has yet to reveal how many of its customers were affected by the data breach, the date its systems were breached, and when the incident was detected.
Ted Miracco, CEO, Approov Mobile Security had this to say:
“The fact that Air Europa has experienced multiple data breaches in a relatively short period raises concerns about the airline’s overall security posture and the effectiveness of its data protection measures. It is also possible that in March 2021, the first data breach experienced by Air Europa, could have just revealed to other hackers that Air Europa had poor security practices in place, or a specific vulnerability was exposed. Regardless, any data breach can make the victim an attractive target for subsequent attacks, including the second breach targeting the credit card payment system. Once vulnerabilities are exposed, it is not uncommon for other malicious actors to exploit them.”
The fact that this is the second go around for this airline to be pwned tells you all you need to know. They are to be avoided as clearly they cannot keep your personal data secure. One has to wonder how long it will take before another attack like this will take them out for good. Because you know another attack is coming based on their track record.