HONG KONG ( REUTERS ) - Cathay Pacific Airways said on Wednesday ( Oct 24 ) that data of about 9.4 million passengers of Cathay and its unit Hong Kong Dragon Airlines had been accessed Attack.Databreach without authorisation . Cathay said 860,000 passport numbers , about 245,000 Hong Kong identity card numbers , 403 expired credit card numbers and 27 credit card numbers with no card verification value ( CVV ) were accessed Attack.Databreach in the breach Attack.Databreach . `` We are very sorry for any concern this data security event may cause our passengers , '' Cathay Pacific chief executive Rupert Hogg said in a statement . `` We acted immediately to contain the event , commence a thorough investigation with the assistance of a leading cyber-security firm , and to further strengthen our IT security measures . '' Mr Hogg said no passwords were compromised Attack.Databreach in the breach Attack.Databreach and the company was contacting affected passengers to give them information on how to protect themselves . Cathay Pacific was not immediately available for additional comment outside normal business hours . The company said it initially discovered suspicious activity on its network in March this year , and investigations in early May confirmed that certain personal data had been accessed Attack.Databreach . News of Cathay 's passenger data breach Attack.Databreach comes weeks after British Airways revealed that credit card details of hundreds of thousands of its customers were stolen Attack.Databreach over a two-week period . Cathay said in a statement that accessed Attack.Databreach data includes names of passengers , their nationalities , dates of birth , telephone numbers , e-mail and physical addresses , passport numbers , identity card numbers and historical travel information . It added that the Hong Kong Police had been notified about the breach Attack.Databreach and that there is no evidence any personal information has been misused .

Hacker used flaw in web server to access Attack.Databreach data uploaded to website of holiday and travel association . Hackers used a flaw in the web server running the website of ABTA , the UK 's largest holiday and travel association , to access Attack.Databreach the data of as many as 43,000 people . ABTA CEO Mark Tanzer says an `` external infiltrator '' used a vulnerability in the firm 's web server to access Attack.Databreach data provided by its members and some of those members ' customers . ABTA is the UK 's largest travel association , representing travel agents and tour operators that sell £32bn of holidays and other travel each year . It said the unauthorised access Attack.Databreach -- on 27 February 2017 -- may have affected 43,000 individuals . Around 1,000 of the accessed files may include personal identity information relating to customers of ABTA members , submitted in support of their complaint about an ABTA member . These files relate to complaints uploaded to ABTA after 11 January 2017 . Additionally , around 650 files may include personal identity information of ABTA members . But Tanzer said : `` We are not aware of any information being shared Attack.Databreach beyond the infiltrator . '' The travel trade association said the vast majority of the 43,000 were people who had registered on abta.com , with email addresses and encrypted passwords , or have filled in an online form with basic contact details `` which are types of data at a very low exposure risk to identity theft or online fraud '' . Once it became aware of the intrusion , ABTA notified the third-party suppliers of the abta.com website , who immediately fixed Vulnerability-related.PatchVulnerability the vulnerability , and the association hired risk consultants to assess the potential extent of the incident . It has also alerted the Information Commissioner and the police . `` It is extremely disappointing that our web server , managed for ABTA through a third party web developer and hosting company , was compromised , and we are taking every step we can to help those affected , '' said Tanzer . ABTA said Vulnerability-related.DiscoverVulnerability its own systems remained secure and the vulnerability was in the web server for abta.com , which is managed for ABTA through a third-party web developer and hosting company . The association said that ABTA members or members of the public who have registered on abta.com should immediately change their password and , if they used this password or any variation of it for other accounts , they should change that too . It said ABTA members who have used ABTA 's online self-service facility to upload supporting documentation relating to their membership may have had their data accessed Attack.Databreach , and `` should remain vigilant regarding online and identity fraud '' .

Criminals are attempting to trick Attack.Phishing consumers into handing over passwords and credit card details by taking advantage of the flood of emails being sent out Attack.Phishing ahead of new European privacy legislation . The European Union 's new General Data Protection Regulation ( GDPR ) come into force on 25 May and the policy is designed to give consumers more control over their online data . As a result , in the run-up to it , organisations are sending out Attack.Phishing messages to customers to gain their consent for remaining on their mailing lists . With so many of these messages being sent out Attack.Phishing , it was perhaps only a matter of time before opportunistic cybercriminals looked to take advantage of the deluge of messages about GDPR and privacy policies arriving in people 's inboxes . A GDPR-related phishing scam Attack.Phishing uncovered by researchers at cyber security firm Redscan is doing just this in an effort to steal data with emails claiming to be Attack.Phishing from Airbnb . The attackers appear to be Attack.Phishing targeting business email addresses , which suggests the messages are sent Attack.Phishing to emails scraped from the web . The phishing message addresses the user as an Airbnb host and claims Attack.Phishing they 're not able to accept new bookings or send Attack.Phishing messages to prospective guests until a new privacy policy is accepted . `` This update is mandatory because of the new changes in the EU Digital privacy legislation that acts upon United States based companies , like Airbnb in order to protect European citizens and companies , '' the message says , and the recipient is urged Attack.Phishing to click a link to accept the new privacy policy . Those who click the link are asked to enter their personal information , including account credentials and payment card information . If the user enters these , they 're handing the data straight into the hands of criminals who can use it for theft , identity fraud , selling on the dark web and more . `` The irony wo n't be lost on anyone that cybercriminals are exploiting the arrival of new data protection regulations to steal Attack.Databreach people 's data , '' said Mark Nicholls , Director of Cyber Security at Redscan . `` Scammers know that people are expecting exactly these kinds of emails this month and that they are required to take action , whether that 's clicking a link or divulging personal data . It 's a textbook phishing campaign Attack.Phishing in terms of opportunistic timing and having a believable call to action '' . Airbnb is sending messages to users about GDPR , but the messages contain far more detail and do n't ask the users to enter any credentials , merely agree to the new Terms of Service . While the phishing messages might look legitimate at first glance , it 's worth noting they do n't use the right domain - the fake messages come from Attack.Phishing ' @ mail.airbnb.work ' as opposed to ' @ airbnb.com ' . Redscan has warned that attackers are likely to use GDPR as bait Attack.Phishing for other phishing scams Attack.Phishing , with messages claiming to be Attack.Phishing from other well-known companies . `` As we get closer to the GDPR implementation deadline , I think we can expect to see a lot a lot more of these types of phishing scams Attack.Phishing over the next few weeks , that 's for sure , '' said Nicholls , who warned attackers could attempt to use the ploy to deliver malware in future . `` In the case of the Airbnb scam email , hackers were attempting to harvest Attack.Databreach credentials . Attack vectors do vary however and it 's possible that other attacks may attempt to infect hosts with keyloggers or ransomware , for example . '' he said . Airbnb said those behind the attacks have n't accessed Attack.Databreach user details in order to send Attack.Phishing emails and that users who receive Attack.Phishing a suspicious message claiming to be Attack.Phishing from Airbnb should send it to their safety team . `` These emails are a brazen attempt at using our trusted brand to try and steal Attack.Databreach user 's details , and have nothing to do with Airbnb . We 'd encourage anyone who has received Attack.Phishing a suspicious looking email to report it to our Trust and Safety team on report.phishing @ airbnb.com , who will fully investigate , '' an Airbnb spokesperson told ZDNet . Airbnb also provided information on how to spot a fake email to help users to determine if a message is genuine or not .

About 1,000 files accessed Attack.Databreach may include personal identity information of individuals who have made a complaint about an Abta-registered travel agent . It says it is contacting those affected by the hack which happened on 27 February and has a dedicated helpline . It has also alerted the police and the Information Commissioner 's Office ( ICO ) . Part of the ICO 's role is to help the public manage their personal data . Abta chief executive Mark Tanzer said he would `` personally like to apologise for the anxiety and concern '' caused to Abta customers and members . `` It is extremely disappointing that our web server , managed for Abta through a third party web developer and hosting company , was compromised and we are taking every step we can to help those affected . '' Mr Tanzer said the organisation was not aware of any of the information being shared Attack.Databreach beyond the infiltrator . The organisation gives advice and guidance to holidaymakers , sets standards for travel firms and promotes responsible tourism in the UK and abroad . It said the type of data which may have been accessed Attack.Databreach included : Abta said the `` vast majority '' of the 43,000 people affected were those who had registered with email addresses and encrypted passwords or had filled in an online form with basic contact details . It said there was `` a very low exposure risk to identity theft or online fraud '' with this kind of data . It advised customers and ABTA members registered on the site to change their passwords as a `` precautionary measure '' . It has also offered people who may be affected a free-of-charge identity theft protection service .

The mobile phone company Three has experienced a fresh data breach Attack.Databreach after some customers logging into their accounts were presented with the names , addresses , phone numbers and call histories of strangers . Three said Vulnerability-related.DiscoverVulnerability it was investigating Vulnerability-related.DiscoverVulnerability a technical issue with its systems and urged those affected to contact its customer service department . One customer , Andy Fidler , told the Guardian he was presented with the data usage and full call and text history of another named customer when he logged in on Sunday night . Another , Mark Thompson , said on Facebook he received a call from a complete stranger who said she had logged on to her account and was shown his details . Thompson said it was a “ shocking breach of data privacy Attack.Databreach ” . He wrote on Three UK ’ s Facebook page : “ Care to explain just how my details have been shared , how many people have had access Attack.Databreach to my personal information , for how long , and how many of your other customers have had their details leaked Attack.Databreach by yourselves to other members of the public as well ? ” Other customers also wanted to know why they were being presented with other people ’ s information when they logged in . Three UK , which is owned by the telecoms giant Hutchinson and has 9 million customers in Britain , said it was investigating . “ We are aware of a small number of customers who may have been able to view the mobile account details of other Three users using My3 , ” a spokesman said . “ No financial details were viewable during this time and we are investigating the matter ” . The Information Commissioner ’ s Office said it “ will be looking into this potential incident involving Three ” . A spokeswoman for the regulator said : “ Data protection law requires organisations to keep any personal information they hold secure . It ’ s our job to act on behalf of consumers to see whether that ’ s happened and take appropriate action if it has not ” . The problem comes four months after three men were arrested after fraudsters accessed Attack.Databreach personal data of thousands of Three customers , including names and addresses , by using authorised logins to its database of customers eligible for an upgraded handset . Customer information from more than 133,000 users was compromised Attack.Databreach in the incident Attack.Databreach .

Northrop Grumman has admitted one of its internal portals was broken into , exposing Attack.Databreach employees ' sensitive tax records to miscreants . In a letter [ PDF ] to workers and the California Attorney General 's office , the aerospace contractor said that between April 18 , 2016 and March 29 , 2017 , crooks infiltrated the website , allowing them to access Attack.Databreach staffers ' W-2 paperwork for the 2016 tax year . These W-2 forms can be used by identity thieves to claim tax rebates owed to employees , allowing the crims to pocket victims ' money . The corp sent out its warning letters on April 18 , the last day to file 2016 tax returns . `` The personal information that may have been accessed Attack.Databreach includes your name , address , work email address , work phone number , Social Security number , employer identification number , and wage and tax information , as well as any personal phone number , personal email address , or answers to customized security questions that you may have entered on the W-2 online portal , '' the contractor told its employees . The Stealth Bomber maker says it will provide all of the exposed workers with three years of free identity-theft monitoring services . Northrop Grumman has also disabled access to the W-2 portal through any method other than its internal single sign-on tool . The aerospace giant said it farmed out its tax portal to Equifax Workforce Solutions , which was working with the defense giant to get to the bottom of the intrusion . `` Promptly after confirming the incident , we worked with Equifax to determine the details of the issue , '' Northrop told its teams . `` Northrop Grumman and Equifax are coordinating with law enforcement authorities to assist them in their investigation of recent incidents Attack.Databreach involving unauthorized actors gaining access Attack.Databreach to individuals ’ personal information through the W-2 online portal . '' According to Equifax , the portal was accessed Attack.Databreach not by hackers but by someone using stolen login details . `` We are investigating alleged unauthorized access Attack.Databreach to our online portal where a person or persons using stolen credentials accessed Attack.Databreach W-2 information of a limited number of individuals , '' an Equifax spokesperson told El Reg on Monday . `` Based on the investigation to date , Equifax has no reason to believe that its systems were compromised Attack.Databreach or that it was the source of the information used to gain access Attack.Databreach to the online portal . ''

News Corp is a network of leading companies in the worlds of diversified media , news , education , and information services . Addresses , names and phone numbers for staff were accessed Attack.Databreach in the data breach Attack.Databreach SPORTS Direct failed to tell its workers about a major data breach Attack.Databreach that saw personal information accessed Attack.Databreach by hackers . A cyber attacker gained access Attack.Databreach to internal systems containing details for phone numbers , names and home and email addresses of the retail giant's 30,000 staff members . But according to The Register , workers still have n't been told about the breach Attack.Databreach , which took place in September . Sports Direct discovered the attack Attack.Databreach three months later after a phone number was left Attack.Databreach on the company 's internal site with a message encouraging bosses to make contact . Chiefs filed a report with the Information Commissioner 's office after it became aware that personal information had been compromised Attack.Databreach . But as there was no evidence the data had been shared Attack.Databreach , Sports Direct did n't report the breach Attack.Databreach to staff . The blunder is the latest in a string of controversies surrounding the sporting goods retailer . Allegations also surfaced of some workers being promised permanent contracts in exchange for sexual favours . Committee chairman Iain Wright said evidence heard by MPs last year suggested Sports Direct 's working practices `` are closer to that of a Victorian workhouse than that of a modern , reputable High Street retailer '' . In November , six MPs from the Business and Skills Committee said attempts were made to record their private discussions when they visited Sport Direct to investigate working practices . A spokesman for Sports Direct said : `` We can not comment on operational matters in relation to cyber-security for obvious reasons .