{"id":250734,"date":"2021-03-05T12:13:38","date_gmt":"2021-03-05T11:13:38","guid":{"rendered":"https:\/\/www.borncity.com\/blog\/?p=250734"},"modified":"2024-02-11T19:00:20","modified_gmt":"2024-02-11T18:00:20","slug":"passagierdaten-der-star-alliance-lufthansa-co-bei-sita-hack-erbeutet","status":"publish","type":"post","link":"https:\/\/borncity.com\/blog\/2021\/03\/05\/passagierdaten-der-star-alliance-lufthansa-co-bei-sita-hack-erbeutet\/","title":{"rendered":"Passagierdaten der Star Alliance (Lufthansa & Co.) bei Sita-Hack erbeutet"},"content":{"rendered":"

[English<\/a>]Unsch\u00f6ne Geschichte – die Server des Dienstleisters SITA (ein IT-Dienstleister f\u00fcr die Luftfahrtindustrie, der mit der IATA kooperiert) wurden gehackt. Kundendaten von Flugreisenden der Star Allicance (u.a. Lufthansa) sind dabei in die H\u00e4nde von Hackern geraten. Lufthansa, aber auch Singapore Airlines, haben inzwischen wohl Kunden informiert.<\/p>\n

<\/p>\n

SITA best\u00e4tigt Hack des PSS<\/h2>\n

SITA ist ein genossenschaftlich organisierter<\/a> (IT-)Dienstleistungsbereich von Mitgliedern der Luftfahrtbranche, der mit der IATA<\/a> (International Air Transport Association), des Dachverbands der Fluggesellschaften, zusammen arbeitet. Der Anbieter wirbt damit, dass er der weltweit f\u00fchrende Spezialist f\u00fcr Kommunikations- und Informationstechnologie im Luftverkehr ist. Vor einigen Stunden hat SITA bekannt gegeben, dass man Opfer eines Cyber-Angriffs geworden sei. Hier die Stellungnahme (Quellen: Presseinfo<\/a> und hier<\/a>):<\/p>\n

SITA confirms that it was the victim of a cyber-attack, leading to a data security incident involving certain passenger data that was stored on SITA Passenger Service System (US) Inc. servers. Passenger Service System (US) Inc. (\"SITA PSS\") operates passenger processing systems for airlines.<\/p>\n

After confirmation of the seriousness of the data security incident on February 24, 2021, SITA took immediate action to contact affected SITA PSS customers and all related organizations.<\/p>\n

We recognize that the COVID-19 pandemic has raised concerns about security threats, and, at the same time, cyber-criminals have become more sophisticated and active. This was a highly sophisticated attack.<\/p>\n

SITA acted swiftly and initiated targeted containment measures. The matter remains under continued investigation by SITA's Security Incident Response Team with the support of leading external experts in cyber-security.<\/p>\n

If you are the customer of an airline and have a Data Subject Access Request in relation to the handling of your personal data, this request must be made directly to that airline in accordance with GDPR and data protection legislation. SITA is unable to respond directly to any such request.<\/p><\/blockquote>\n

Konkret wurde das SITA Passenger Service System gehackt, also die Server, auf denen Passagierdaten von Fluggesellschaften gespeichert waren. Muss wohl am 24. Februar 2021 aufgefallen sein. Details nennt die SITA keine – ich habe aber entsprechende Informationen \u00fcber Fluglinien herausgefunden. Es d\u00fcrften Hundertausende Mitglieder im Vielflieger-Programm betroffen sein.<\/p>\n

Fluggesellschaften (Lufthansa & Co) informieren<\/h2>\n

Singapore Airlines hat vor einigen Stunden ausgew\u00e4hlte Mitglieder des KrisFlyer-Programms, deren Mitgliedsdaten bei obigem SITA PSS-Hack betroffen sind, \u00fcber den Vorfall informiert. Auf vielfliegertreff.de<\/a> hat jemand die Benachrichtigung im KrisFlyer-Programm gepostet.<\/p>\n

IMPORTANT INFORMATION ABOUT YOUR KRISFLYER ACCOUNT<\/p>\n

SITA, an information technology company providing passenger service systems, has informed Singapore Airlines of a data security breach involving their passenger service systems' (SITA PSS) servers. While Singapore Airlines is not a customer of the SITA PSS, another Star Alliance member airline is.<\/p>\n

All Star Alliance member airlines provide a restricted set of frequent flyer programme data to the alliance, which is then sent on to other member airlines to reside in their passenger service systems. This data transfer is necessary to enable the verification of membership tier status, and to accord to member airlines' customers the relevant benefits while travelling.<\/p>\n

As a result, SITA has access to the restricted set of frequent flyer programme data for all 26 Star Alliance member airlines including Singapore Airlines.<\/p>\n

We are contacting you as your KrisFlyer data was impacted by this breach of the SITA PSS server. The information involved is limited to your KrisFlyer membership name, membership number and tier status, which is the full extent of the frequent flyer data set that Singapore Airlines shares with other Star Alliance member airlines for this data transfer.<\/p>\n

Specifically, this data breach does not involve your membership password, credit card information, and other customer data such as itineraries, reservations, ticketing, passport numbers, and email addresses as SIA does not share this information with other Star Alliance member airlines for this data transfer. Your KrisFlyer miles balance was also not compromised.<\/p>\n

We would also like to reassure you that none of Singapore Airlines' IT systems have been affected by this incident. The protection of our customers' personal data is of utmost importance to Singapore Airlines. We apologise for the inconvenience caused. We will work with our partners to review the current procedures, and take all necessary steps to improve data security.<\/p><\/blockquote>\n

Der Beef aus dieser Benachrichtigung: Betroffen sind alle 26 Mitglieder der Star Allicance<\/a>, also auch die Lufthansa, Swiss, Austrian Air, Finn Air etc. Beim Hack wurden folgende Daten aus dem Vielflieger Mitgliedsprogramm (betr\u00e4fe auch Miles & More der Lufthansa) erbeutet:<\/p>\n