Secrets and whys

Some 860,000 passport numbers, 245,000 Hong Kong identity card numbers, 403 expired credit card numbers and 27 credit card numbers with no card verification value (CVV) were accessed in the breach. Other compromised data included dates of birth, telephone numbers, email and physical addresses.

It rates as arguably the most serious cyber-attack on one of the region’s carriers but should hardly have come as a surprise. Earlier in the year British Airways revealed it had been targeted with information stolen relating to about 185,000 of its customers, including records containing names, billing and email addresses, and payment information such as card numbers, expiry dates and CVVs linked to each card.

Experts and industry bodies both airlines and airports have warned for a long time that, for airlines, cyber-attacks are not a matter of “if”, but “when”.
What is disturbing about the Cathay case is that the airline took so long to inform customers there had been breach. Cathay’s Chief Customer and Commercial Officer, Paul Loo, said officials wanted to have an accurate grasp on the situation before making an announcement and did not wish to “create unnecessary panic.”

In a statement, Hogg added: “We are very sorry for any concern this data security event may cause our passengers. We acted immediately to contain the event, commence a thorough investigation with the assistance of a leading cyber-security firm, and to further strengthen our IT security measures.”

He said no passwords were compromised in the breach and that “we have no evidence that any personal data has been misused”. Passengers were also provided with solutions to protect themselves.

That was hardly the point. What is crucial in the case of cyber-attacks on airlines is that information is communicated to passengers, and throughout the industry, at the earliest possible opportunity.

In February, the AAPA called on the region’s aviation industry to co-operate on strengthening cyber security because increasing digital connectivity makes it a bigger target for hackers. It joined forces with the Qantas Group (not an AAPA member), Australia’s Foreign Affairs Department, Singapore’s Ministry of Transport and the Civil Aviation Authority of Singapore to find ways to strengthen cyber resilience through a series of interactive workshops.

The workshops were designed to bring together stakeholders to examine issues such as risk awareness, strategic planning, strengthening resilience and fostering links within aviation.

“The risk of cyber-attacks is ever present,’’ said AAPA director general Andrew Herdman.

“Although our cyber-security defenses may be robust, it is never enough. In the long term, system breaches and break-ins are inevitable.”
He is right.

There is something else to keep in mind. On May 25, a new General Data Protection Regime (GDPR) came into effect in Europe applying not only to European airlines but any carrier flying into Europe, as Cathay and most other Asia-Pacific-based airlines do.

The regime requires airlines to report data breaches within 72 hours of becoming aware of an attack. Failure to report the breach could attract a penalty of up to four per cent of a company’s turnover which, in Cathay’s case, would be as much as $A700 million based on last year’s revenue of about $A17.5 billion.
It remains to be seen if European authorities move to take any action, but the event should be a serious warning to all airlines that there needs to be speedy communication within the industry as soon as breaches are detected.

Some meetings between airline chiefs at the Jeju gathering were held in private so it is not known whether Hogg gave his counterparts from other carriers any indication that Cathay’s systems had been hacked. The issue of cyber-attack threats was, however, one of the topics for discussion at the assembly.

For Cathay, the attack is a major issue. It has been battling to stem losses in the face of pressure from lower-cost Chinese carriers, budget airlines and Middle-East-based rivals. In March, it booked its first back-to-back annual loss in its seven-decade history and had already pledged to cut 600 staff, including a quarter of its management, as part of its biggest overhaul in years.

The last thing it needed was damage to its brand and suspicion among its frequent flyers that large amounts of their personal details are at risk.
Ultimately, though, the attack delivers a timely message that when a cyber breach does occur, others in the industry need to know about it as quickly as possible.