India’s Akasa Air exposed thousands of consumers’ private data
- ByStartupStory | August 29, 2022
Because of a technical malfunction that crippled its login and sign-up service, Akasa Air, India’s newly founded airline that began operations earlier this month, exposed the personal data of thousands of its clients. Ashutosh Barot, a cybersecurity researcher, uncovered the exposed data, which includes full names, genders, email addresses, and phone numbers of consumers signing up and logging in on the Akasa Air website. On August 7, the researcher discovered an HTTP request revealing the data minutes after visiting Akasa Air’s website. He attempted to call the security personnel at the Mumbai-based airline directly at first but was unsuccessful.
“I contacted the airline using their official Twitter account, asking for an email address to report the problem.” They provided me with the info@akasa email address, which I did not share the vulnerability information with because it may be handled by support employees or third-party suppliers. So I emailed them again, this time asking [the airline] for [the] email address of someone on their security staff. “I didn’t hear anything else from Akasa,” the researcher stated. When we contacted Akasa Air, they responded swiftly and acknowledged that the issue had put 34,533 unique customer details in danger. The airline further stated that the exposed data did not include any trip or payment details.
“I am delighted the airline addressed the problem quickly and reported it to CERT-In, as well as alerted its customers about the occurrence,” the researcher stated.
Follow Startup Story
Related Posts
