Cathay Pacific fined 500,000 euros by British ICO for data breach revealed in 2018 – TechCrunch

Cathay Pacific was fined $ 500,000 by the UK data monitoring service for security breaches, which revealed the personal information of some 9.4 million customers worldwide, including 111 578 from the United Kingdom.

The fine, which is the maximum possible fine under applicable UK law, has been announced today by the Information Commissioner (ICO), following an investigation of several months. This is a violation disclosed by the airline in the fall of 2018.

At the time, Cathay Pacific said it identified unauthorized access to its systems for the first time in March, but it did not explain why it took more than six months to publicly disclose the system. ;offense.

Failure to secure its systems resulted in unauthorized access to passenger personal data, including names, passport and identity details, dates of birth, postal and email addresses, phone numbers and historical travel information.

The OIC announced today that the first date of unauthorized access to Cathay Pacific systems was October 14, 2014. While the first known date of unauthorized access to personal data was February 7, 2015.

"The ICO discovered that the Cathay Pacifics systems were entered via a server connected to the Internet and that malware was installed to collect the data", writes the regulator in a Press release, adding that he found "a catalog of errors" during the investigation, including backup files that were not password protected; uncorrected Internet servers; use of operating systems that were no longer supported by the developer; and inadequate antivirus protection.

Since Cathay's systems have been compromised in this breach, the UK has released an update The European Union the data protection framework in its national law, which provides for strict disclosure requirements for breaches involving personal data – data controllers must inform national regulators within 72 hours after becoming aware of a violation.

The General Data Protection Regulation (GDPR) also includes a much more substantial sanctions regime – with fines of up to 4% of annual global turnover.

However, due to the timing of the unauthorized access, the ICO treated this breach as falling under previous UK data protection law.

Under the GDPR, the airline would likely have been fined much more.

Commenting on the Cathay Pacific sanction in a statement, Steve Eckersley, Director of Investigations of the OIC, said:

People rightly expect, when they provide their personal information to a business, that this information will be kept secure in order to ensure that it is protected from harm. or potential fraud. This just was not the case here.

This violation was of particular concern given the number of basic security deficiencies in the Cathay Pacifics system, which allowed easy access to hackers. The multiple serious impairments that we have observed are far below the expected standard. Basically, the airline failed to meet four of the National Cyber ​​Security Centers Cyber ​​Essentials' five basic guidelines.

Under data protection law, organizations must put in place appropriate security measures and robust procedures to ensure that any attempt to infiltrate computer systems is made as difficult as possible.

Called for comment, the airline reiterated its regret for the data breach and said it had taken steps to improve its security "in the areas of data governance, network security and access control , employee education and awareness and incident response agility. "

"Significant sums have been spent on IT infrastructure and security in the past three years and investments in these areas will continue," said Cathay Pacific in the release. "We have cooperated closely with the OIC and other relevant authorities in their investigations. Our investigation reveals that there is no evidence of misuse of personal data to date. However, we are aware that in today's world, as the sophistication of cyber attackers continues to increase, we must and will continue to invest and evolve our systems. IT security. "

"We will continue to cooperate with the relevant authorities to demonstrate our compliance and our continued commitment to protecting personal data," he added.

Last summer, the ICO slapped another airline, British Airways, with a much more substantial fine for a breach that released data on 500,000 customers, also due to security breaches.

In this case, the airline faced a record penalty of 183.39 million euros – totaling 1.5% of its total revenue for 2018 – as the time of the violation occurred when of the application of the GDPR.