without authorisation . Cathay said 860,000 passport numbers , about 245,000 Hong Kong identity card numbers , 403 expired credit card numbers and 27 credit card numbers with no card verification value ( CVV ) were accessedAttack.Databreachin the breachAttack.Databreach. `` We are very sorry for any concern this data security event may cause our passengers , '' Cathay Pacific chief executive Rupert Hogg said in a statement . `` We acted immediately to contain the event , commence a thorough investigation with the assistance of a leading cyber-security firm , and to further strengthen our IT security measures . '' Mr Hogg said no passwords were compromisedAttack.Databreachin the breachAttack.Databreachand the company was contacting affected passengers to give them information on how to protect themselves . Cathay Pacific was not immediately available for additional comment outside normal business hours . The company said it initially discovered suspicious activity on its network in March this year , and investigations in early May confirmed that certain personal data had been accessedAttack.Databreach. News of Cathay 's passenger data breachAttack.Databreachcomes weeks after British Airways revealed that credit card details of hundreds of thousands of its customers were stolenAttack.Databreachover a two-week period . Cathay said in a statement that accessedAttack.Databreachdata includes names of passengers , their nationalities , dates of birth , telephone numbers , e-mail and physical addresses , passport numbers , identity card numbers and historical travel information . It added that the Hong Kong Police had been notified about the breachAttack.Databreachand that there is no evidence any personal information has been misused .
Hacker used flaw in web server to accessAttack.Databreachdata uploaded to website of holiday and travel association . Hackers used a flaw in the web server running the website of ABTA , the UK 's largest holiday and travel association , to accessAttack.Databreachthe data of as many as 43,000 people . ABTA CEO Mark Tanzer says an `` external infiltrator '' used a vulnerability in the firm 's web server to accessAttack.Databreachdata provided by its members and some of those members ' customers . ABTA is the UK 's largest travel association , representing travel agents and tour operators that sell £32bn of holidays and other travel each year . It said the unauthorised accessAttack.Databreach-- on 27 February 2017 -- may have affected 43,000 individuals . Around 1,000 of the accessed files may include personal identity information relating to customers of ABTA members , submitted in support of their complaint about an ABTA member . These files relate to complaints uploaded to ABTA after 11 January 2017 . Additionally , around 650 files may include personal identity information of ABTA members . But Tanzer said : `` We are not aware of any information being sharedAttack.Databreachbeyond the infiltrator . '' The travel trade association said the vast majority of the 43,000 were people who had registered on abta.com , with email addresses and encrypted passwords , or have filled in an online form with basic contact details `` which are types of data at a very low exposure risk to identity theft or online fraud '' . Once it became aware of the intrusion , ABTA notified the third-party suppliers of the abta.com website , who immediately fixedVulnerability-related.PatchVulnerabilitythe vulnerability , and the association hired risk consultants to assess the potential extent of the incident . It has also alerted the Information Commissioner and the police . `` It is extremely disappointing that our web server , managed for ABTA through a third party web developer and hosting company , was compromised , and we are taking every step we can to help those affected , '' said Tanzer . ABTA saidVulnerability-related.DiscoverVulnerabilityits own systems remained secure and the vulnerability was in the web server for abta.com , which is managed for ABTA through a third-party web developer and hosting company . The association said that ABTA members or members of the public who have registered on abta.com should immediately change their password and , if they used this password or any variation of it for other accounts , they should change that too . It said ABTA members who have used ABTA 's online self-service facility to upload supporting documentation relating to their membership may have had their data accessedAttack.Databreach, and `` should remain vigilant regarding online and identity fraud '' .
Criminals are attempting to trickAttack.Phishingconsumers into handing over passwords and credit card details by taking advantage of the flood of emails being sent outAttack.Phishingahead of new European privacy legislation . The European Union 's new General Data Protection Regulation ( GDPR ) come into force on 25 May and the policy is designed to give consumers more control over their online data . As a result , in the run-up to it , organisations are sending outAttack.Phishingmessages to customers to gain their consent for remaining on their mailing lists . With so many of these messages being sent outAttack.Phishing, it was perhaps only a matter of time before opportunistic cybercriminals looked to take advantage of the deluge of messages about GDPR and privacy policies arriving in people 's inboxes . A GDPR-related phishing scamAttack.Phishinguncovered by researchers at cyber security firm Redscan is doing just this in an effort to steal data with emails claiming to beAttack.Phishingfrom Airbnb . The attackers appear to beAttack.Phishingtargeting business email addresses , which suggests the messages are sentAttack.Phishingto emails scraped from the web . The phishing message addresses the user as an Airbnb host and claimsAttack.Phishingthey 're not able to accept new bookings or sendAttack.Phishingmessages to prospective guests until a new privacy policy is accepted . `` This update is mandatory because of the new changes in the EU Digital privacy legislation that acts upon United States based companies , like Airbnb in order to protect European citizens and companies , '' the message says , and the recipient is urgedAttack.Phishingto click a link to accept the new privacy policy . Those who click the link are asked to enter their personal information , including account credentials and payment card information . If the user enters these , they 're handing the data straight into the hands of criminals who can use it for theft , identity fraud , selling on the dark web and more . `` The irony wo n't be lost on anyone that cybercriminals are exploiting the arrival of new data protection regulations to stealAttack.Databreachpeople 's data , '' said Mark Nicholls , Director of Cyber Security at Redscan . `` Scammers know that people are expecting exactly these kinds of emails this month and that they are required to take action , whether that 's clicking a link or divulging personal data . It 's a textbook phishing campaignAttack.Phishingin terms of opportunistic timing and having a believable call to action '' . Airbnb is sending messages to users about GDPR , but the messages contain far more detail and do n't ask the users to enter any credentials , merely agree to the new Terms of Service . While the phishing messages might look legitimate at first glance , it 's worth noting they do n't use the right domain - the fake messages come fromAttack.Phishing' @ mail.airbnb.work ' as opposed to ' @ airbnb.com ' . Redscan has warned that attackers are likely to use GDPR as baitAttack.Phishingfor other phishing scamsAttack.Phishing, with messages claiming to beAttack.Phishingfrom other well-known companies . `` As we get closer to the GDPR implementation deadline , I think we can expect to see a lot a lot more of these types of phishing scamsAttack.Phishingover the next few weeks , that 's for sure , '' said Nicholls , who warned attackers could attempt to use the ploy to deliver malware in future . `` In the case of the Airbnb scam email , hackers were attempting to harvestAttack.Databreachcredentials . Attack vectors do vary however and it 's possible that other attacks may attempt to infect hosts with keyloggers or ransomware , for example . '' he said . Airbnb said those behind the attacks have n't accessedAttack.Databreachuser details in order to sendAttack.Phishingemails and that users who receiveAttack.Phishinga suspicious message claiming to beAttack.Phishingfrom Airbnb should send it to their safety team . `` These emails are a brazen attempt at using our trusted brand to try and stealAttack.Databreachuser 's details , and have nothing to do with Airbnb . We 'd encourage anyone who has receivedAttack.Phishinga suspicious looking email to report it to our Trust and Safety team on report.phishing @ airbnb.com , who will fully investigate , '' an Airbnb spokesperson told ZDNet . Airbnb also provided information on how to spot a fake email to help users to determine if a message is genuine or not .
About 1,000 files accessedAttack.Databreachmay include personal identity information of individuals who have made a complaint about an Abta-registered travel agent . It says it is contacting those affected by the hack which happened on 27 February and has a dedicated helpline . It has also alerted the police and the Information Commissioner 's Office ( ICO ) . Part of the ICO 's role is to help the public manage their personal data . Abta chief executive Mark Tanzer said he would `` personally like to apologise for the anxiety and concern '' caused to Abta customers and members . `` It is extremely disappointing that our web server , managed for Abta through a third party web developer and hosting company , was compromised and we are taking every step we can to help those affected . '' Mr Tanzer said the organisation was not aware of any of the information being sharedAttack.Databreachbeyond the infiltrator . The organisation gives advice and guidance to holidaymakers , sets standards for travel firms and promotes responsible tourism in the UK and abroad . It said the type of data which may have been accessedAttack.Databreachincluded : Abta said the `` vast majority '' of the 43,000 people affected were those who had registered with email addresses and encrypted passwords or had filled in an online form with basic contact details . It said there was `` a very low exposure risk to identity theft or online fraud '' with this kind of data . It advised customers and ABTA members registered on the site to change their passwords as a `` precautionary measure '' . It has also offered people who may be affected a free-of-charge identity theft protection service .
The mobile phone company Three has experienced a fresh data breachAttack.Databreachafter some customers logging into their accounts were presented with the names , addresses , phone numbers and call histories of strangers . Three saidVulnerability-related.DiscoverVulnerabilityit was investigatingVulnerability-related.DiscoverVulnerabilitya technical issue with its systems and urged those affected to contact its customer service department . One customer , Andy Fidler , told the Guardian he was presented with the data usage and full call and text history of another named customer when he logged in on Sunday night . Another , Mark Thompson , said on Facebook he received a call from a complete stranger who said she had logged on to her account and was shown his details . Thompson said it was a “ shocking breach of data privacyAttack.Databreach” . He wrote on Three UK ’ s Facebook page : “ Care to explain just how my details have been shared , how many people have had accessAttack.Databreachto my personal information , for how long , and how many of your other customers have had their details leakedAttack.Databreachby yourselves to other members of the public as well ? ” Other customers also wanted to know why they were being presented with other people ’ s information when they logged in . Three UK , which is owned by the telecoms giant Hutchinson and has 9 million customers in Britain , said it was investigating . “ We are aware of a small number of customers who may have been able to view the mobile account details of other Three users using My3 , ” a spokesman said . “ No financial details were viewable during this time and we are investigating the matter ” . The Information Commissioner ’ s Office said it “ will be looking into this potential incident involving Three ” . A spokeswoman for the regulator said : “ Data protection law requires organisations to keep any personal information they hold secure . It ’ s our job to act on behalf of consumers to see whether that ’ s happened and take appropriate action if it has not ” . The problem comes four months after three men were arrested after fraudsters accessedAttack.Databreachpersonal data of thousands of Three customers , including names and addresses , by using authorised logins to its database of customers eligible for an upgraded handset . Customer information from more than 133,000 users was compromisedAttack.Databreachin the incidentAttack.Databreach.
Northrop Grumman has admitted one of its internal portals was broken into , exposingAttack.Databreachemployees ' sensitive tax records to miscreants . In a letter [ PDF ] to workers and the California Attorney General 's office , the aerospace contractor said that between April 18 , 2016 and March 29 , 2017 , crooks infiltrated the website , allowing them to accessAttack.Databreachstaffers ' W-2 paperwork for the 2016 tax year . These W-2 forms can be used by identity thieves to claim tax rebates owed to employees , allowing the crims to pocket victims ' money . The corp sent out its warning letters on April 18 , the last day to file 2016 tax returns . `` The personal information that may have been accessedAttack.Databreachincludes your name , address , work email address , work phone number , Social Security number , employer identification number , and wage and tax information , as well as any personal phone number , personal email address , or answers to customized security questions that you may have entered on the W-2 online portal , '' the contractor told its employees . The Stealth Bomber maker says it will provide all of the exposed workers with three years of free identity-theft monitoring services . Northrop Grumman has also disabled access to the W-2 portal through any method other than its internal single sign-on tool . The aerospace giant said it farmed out its tax portal to Equifax Workforce Solutions , which was working with the defense giant to get to the bottom of the intrusion . `` Promptly after confirming the incident , we worked with Equifax to determine the details of the issue , '' Northrop told its teams . `` Northrop Grumman and Equifax are coordinating with law enforcement authorities to assist them in their investigation of recent incidentsAttack.Databreachinvolving unauthorized actors gaining accessAttack.Databreachto individuals ’ personal information through the W-2 online portal . '' According to Equifax , the portal was accessedAttack.Databreachnot by hackers but by someone using stolen login details . `` We are investigating alleged unauthorized accessAttack.Databreachto our online portal where a person or persons using stolen credentials accessedAttack.DatabreachW-2 information of a limited number of individuals , '' an Equifax spokesperson told El Reg on Monday . `` Based on the investigation to date , Equifax has no reason to believe that its systems were compromisedAttack.Databreachor that it was the source of the information used to gain accessAttack.Databreachto the online portal . ''
News Corp is a network of leading companies in the worlds of diversified media , news , education , and information services . Addresses , names and phone numbers for staff were accessedAttack.Databreachin the data breachAttack.DatabreachSPORTS Direct failed to tell its workers about a major data breachAttack.Databreachthat saw personal information accessedAttack.Databreachby hackers . A cyber attacker gained accessAttack.Databreachto internal systems containing details for phone numbers , names and home and email addresses of the retail giant's 30,000 staff members . But according to The Register , workers still have n't been told about the breachAttack.Databreach, which took place in September . Sports Direct discovered the attackAttack.Databreachthree months later after a phone number was leftAttack.Databreachon the company 's internal site with a message encouraging bosses to make contact . Chiefs filed a report with the Information Commissioner 's office after it became aware that personal information had been compromisedAttack.Databreach. But as there was no evidence the data had been sharedAttack.Databreach, Sports Direct did n't report the breachAttack.Databreachto staff . The blunder is the latest in a string of controversies surrounding the sporting goods retailer . Allegations also surfaced of some workers being promised permanent contracts in exchange for sexual favours . Committee chairman Iain Wright said evidence heard by MPs last year suggested Sports Direct 's working practices `` are closer to that of a Victorian workhouse than that of a modern , reputable High Street retailer '' . In November , six MPs from the Business and Skills Committee said attempts were made to record their private discussions when they visited Sport Direct to investigate working practices . A spokesman for Sports Direct said : `` We can not comment on operational matters in relation to cyber-security for obvious reasons .