The Target: American Airlines, U.S based air travel company.
The Take: Exposure of Personally Identifiable Information including: employee and customer names, dates of birth, mailing addresses, phone numbers, email addresses, driver license numbers, passport numbers, and certain medical information.
The Vector: Using a phishing attack, the threat actor compromised an employee’s Office365 account, and acting with all their permissions, exfiltrated the exposed data.
This breach is a stark reminder of the effective of social engineering attacks and how critical authentication controls are in an overall robust cybersecurity posture. Enforcing multi-factor authentication, reasonably paced password resets, and regular social engineering and phishing awareness training are all effective strategies to mitigate these kinds of breaches to protect a firm’s customer base.