Frontier Airlines Faces Data Breach Investigation Amid Cybersecurity Concerns
Lawyers are already searching for potential victims in a data breach at Frontier Airlines after the Denver-based ultra-low-cost carrier disclosed a potential cybersecurity incident to the Vermont Attorney General late last week. So far, Frontier Airlines has not provided any specific details about the nature of the data breach, including how many customers may have been affected, and what data has been compromised. That lack of information, however, has not stopped national class action law firm Edelson Lechtzin LLP from opening its own investigation into the data breach with a view to potentially suing Frontier for failing to keep its customers’ data secure. A slew of international airlines have been hit by cybersecurity incidents in the last couple of years, the majority of which were linked to a third-party customer service IT platform that was used by numerous high-profile companies. Two of the airlines affected by this widespread breach were Air France and KLM Royal Dutch Airlines, which informed customers last August that anyone who had recently been in touch with their customer service departments could have had their personal data compromised, including their full name, contact details, and frequent flyer status, and the subject line of service request emails. Australian flag carrier had earlier announced that it was also caught up in the same data breach of the software supplied by the US-based company Salesforce. In all of these recent cases, the hackers are not believed to have accessed data such as credit card information or passport numbers, but privacy experts have warned that the stolen data could still be used in a sophisticated identity theft scam. The hack attacks occurred at a time that the entire airline industry was put on alert to the threat posed by international hacking groups, including the infamous Scattered Spider group. Rather than using computer code to hack computer systems, Scattered Spider often uses 'social engineering' to gain access to restricted databases, convincing IT helpdesks to grant them access to sensitive computer systems by pretending they are a real employee who has been locked out of their account. Other airline victims of recent data breaches include Hawaiian Airlines and WestJet. While all of these attacks didn’t have any operational impact, last September, a major cyber attack took down check-in systems at several European Airports, including London Heathrow, Berlin Brandenburg, and Brussels Airport. The check-in system was the Collins Rockwell Muse system, which is owned by Collins Aerospace, a US-based aerospace company. It took days for Collins Aerospace engineers to fix the system, leading to hundreds of flight cancellations and delays. In 2024, Seattle-Tacoma International Airport fell victim to a major ransomware attack that took down check-in and baggage handling systems, as well as information display screens across its terminals for days on end. The Port of Seattle later said that a cyber hacker group known as Rhysida was behind the attack and had threatened to release stolen data from the airport onto the dark web unless a ransom was paid. Officials refused to pay the ransom and promised to beef up its IT security to prevent a similar outage in the future. Frontier Airlines did not immediately respond to a request for comment.