The target: Malindo Air, a Malaysian subsidiary of Indonesia’s Lion Group
The take: Approx. 35 million passenger records, including names, emails, addresses, passport numbers/expiration dates.
The attack vector: Two former employees of a subcontracted e-commerce provider were identified as having “improperly accessed and stole the personal data of our customers.” Malindo Air reiterated that their external controls were not breached and that “services and infrastructure worked as designed and were not compromised in any way.”
Malicious insiders are unfortunately common sources of data breaches, and internal controls and oversight must be put in place to ensure that data is being handled appropriately by both direct employees and subcontracted staff.