Cathay Pacific Hit with Fine for Long-Lasting Breach
The breach, which was active for four years, resulted in the theft of personal information on more than 9 million people.
![](https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/bltc94608acf452fd67/655cf371ab171e040a838b2a/329050_DR23_Graphics_Website_V5_Default_Image_v1.png?width=1280&auto=webp&quality=95&format=jpg&disable=upscale)
The UK's Information Commissioner's Office (ICO) has fined airline Cathay Pacific £500,000 — with a 20% discount to £400,000 if the penalty is paid by March 12 — for basic security inadequacies in a four-year data breach that lasted from 2014 until 2018.
As a result of the breach, the personal data of 9.4 million people was stolen. The stolen information included names, nationalities, dates of birth, phone numbers, email addresses, mailing addresses, passport details, frequent flier numbers, and travel histories.
Among the criticisms levied against Cathay Pacific is that it took months after the breach was found for the airline to notify regulators, a delay the company blamed on the need to fully understand the breach. Other "security inadequacies" noted in the order for the fine include failure to encrypt database backups containing personal data, failure to patch an Internet-facing server against a 10-year-old vulnerability, and using past-end-of-life operating systems on servers.
For more, read here.
Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's featured story: "With New SOL4Ce Lab, Purdue U. and DoE Set Sights on National Security."
About the Author
You May Also Like
Catch the Threat Before it Catches you: Proactive Ransomware Defense
September 5, 2024How to Evaluate Hybrid-Cloud Network Policies and Enhance Security
September 18, 2024DORA and PCI DSS 4.0: Scale Your Mainframe Security Strategy Among Evolving Regulations
September 26, 2024Harnessing the Power of Automation to Boost Enterprise Cybersecurity
October 3, 2024
[Virtual Event] The Essential Guide to Cloud Management
October 17, 2024Black Hat Europe - December 9-12 - Learn More
December 10, 2024SecTor - Canada's IT Security Conference Oct 22-24 - Learn More
October 22, 2024