United, American airlines account fraud highlights hacker focus on travel industry

Travel agencies and websites offer a rich sampling of personal data plus easy ways to cash out

Alex Holden

Alex Holden

More than 20 travel-related websites have experienced data breaches in the past two months, according to a security expert who tracks the trade in stolen data.

Data from those websites is being sold on underground forums by cybercriminals, said Alex Holden, CTO of Hold Security, a company that specializes in monitoring the illegal trade and alerting companies if their data is found.

United Airlines said on Sunday three dozen of its MileagePlus loyalty card accounts were compromised as part of an attack that reused login credentials obtained from a third party.

On Monday, the Associated Press reported that 10,000 customer accounts at American Airlines were compromised. Two of those accounts were used to book free travel or an upgrade, the AP reported, quoting an airline spokeswoman.

Both airlines said the intrusions were not caused by a data breach, and the usernames and passwords were obtained elsewhere.

Gaining control of a loyalty card account is almost as good as cash. For example, a hacker who gains control of an account with tens of thousands of reward miles can sell an airline ticket for cash and then pay for it with stolen miles, Holden said.

"Attacks against airline loyalty programs are very common and profitable," Holden said.

With points or miles in hand, hackers have also used legitimate services such as Points.com, a service for managing multiple rewards programs. Loyalty rewards can be exchanged, redeemed or used for gift cards -- an easy way to cash out.

Holden said analysts at his company see travel-related login credentials circulate on lists sold by cybercriminals. In other cases, it appears travel agencies have been compromised.

His company can sometimes figure out which website has been breached. File names, website structures and data within stolen databases can indicate which site was hacked. Other times, hackers will advertise where the data came from as part of their sales pitch.

Travel-site data is now fetching about the same price in the criminal underground as that from dating and employment websites, both sought by criminals. Dating site information is good for spam, such as hawking Viagra, Holden said.

Information on job-seekers is also good for spammers, as those people can be targeted for work-at-home scams, he said.

Last year, Holden's company uncovered a Russian-based gang that it nicknamed "Cybervor" that had amassed a hefty database of 1.2 billion stolen user names and passwords plus half a billion email addresses. More than 420,000 websites were affected, some likely in the travel industry, he said.

Cybervor was known to have attacked the travel site Expedia.com, Southwest Airlines and several other airlines, Holden said. The gang was sometimes hired by spammers to obtain email addresses from certain services, he said.

Send news tips and comments to jeremy_kirk@idg.com. Follow me on Twitter: @jeremy_kirk

Join the CSO newsletter!

Error: Please check your email address.

Tags securitydata breachHold Security

More about American AirlinesExpediaHoldenSouthwest AirlinesUnited Airlines

Show Comments

Featured Whitepapers

Editor's Recommendations

Solution Centres

Stories by Jeremy Kirk

Latest Videos

  • 150x50

    CSO Webinar: The Human Factor - Your people are your biggest security weakness

    ​Speakers: David Lacey, Researcher and former CISO Royal Mail David Turner - Global Risk Management Expert Mark Guntrip - Group Manager, Email Protection, Proofpoint

    Play Video

  • 150x50

    CSO Webinar: Current ransomware defences are failing – but machine learning can drive a more proactive solution

    Speakers • Ty Miller, Director, Threat Intelligence • Mark Gregory, Leader, Network Engineering Research Group, RMIT • Jeff Lanza, Retired FBI Agent (USA) • Andy Solterbeck, VP Asia Pacific, Cylance • David Braue, CSO MC/Moderator What to expect: ​Hear from industry experts on the local and global ransomware threat landscape. Explore a new approach to dealing with ransomware using machine-learning techniques and by thinking about the problem in a fundamentally different way. Apply techniques for gathering insight into ransomware behaviour and find out what elements must go into a truly effective ransomware defence. Get a first-hand look at how ransomware actually works in practice, and how machine-learning techniques can pick up on its activities long before your employees do.

    Play Video

  • 150x50

    CSO Webinar: Get real about metadata to avoid a false sense of security

    Speakers: • Anthony Caruana – CSO MC and moderator • Ian Farquhar, Worldwide Virtual Security Team Lead, Gigamon • John Lindsay, Former CTO, iiNet • Skeeve Stevens, Futurist, Future Sumo • David Vaile - Vice chair of APF, Co-Convenor of the Cyberspace Law And Policy Community, UNSW Law Faculty This webinar covers: - A 101 on metadata - what it is and how to use it - Insight into a typical attack, what happens and what we would find when looking into the metadata - How to collect metadata, use this to detect attacks and get greater insight into how you can use this to protect your organisation - Learn how much raw data and metadata to retain and how long for - Get a reality check on how you're using your metadata and if this is enough to secure your organisation

    Play Video

  • 150x50

    CSO Webinar: How banking trojans work and how you can stop them

    CSO Webinar: How banking trojans work and how you can stop them Featuring: • John Baird, Director of Global Technology Production, Deutsche Bank • Samantha Macleod, GM Cyber Security, ME Bank • Sherrod DeGrippo, Director of Emerging Threats, Proofpoint (USA)

    Play Video

  • 150x50

    IDG Live Webinar:The right collaboration strategy will help your business take flight

    Speakers - Mike Harris, Engineering Services Manager, Jetstar - Christopher Johnson, IT Director APAC, 20th Century Fox - Brent Maxwell, Director of Information Systems, THE ICONIC - IDG MC/Moderator Anthony Caruana

    Play Video

More videos

Blog Posts