From the latest dark web monitoring of iZOOlogic analysts, we have found that an immense volume of databases owned by Malaysian and UAE-based airline passengers have been marketed on the dark web and underground forums.
A dark web threat actor with the username ‘Bill_Joy’ posted these discovered stolen databases. As seen from the advertisement, both compromised databases of the Malaysian and UAE airline passengers are offered for $1,000 each.
In availing of the offered information, interested buyers can pay through several cryptocurrencies, including BTC, ETH, USDT, or TRC20.
The massive stolen databases of the airline passengers sum up to 16 million rows if combined.
For the airline passengers in Malaysia, the amount of stolen data included in the file has about 12 million rows. On the other hand, the compromised data of UAE-based airline passengers have about four million rows.
We have also learned that the threat actor that posted the stolen databases has not disclosed which specific airline companies were breached. However, they mentioned that the source of these leaked files was an airline company’s hacked network. Our team will be on the lookout until further details are shared about the compromised databases’ actual source.
Since it could be an effective sale advertisement, the threat actor had published a few samples of their stolen files for the interested buyers to review.
Our security experts have also acquired and assessed these samples, revealing that the passengers’ details found on the leaked databases included full names, email addresses, contact details, and the passengers’ countries of origin.
It is also evident from our investigations that the dates of the compromised information are as recent as 2022. Hence, many threat groups could find these databases valuable for further attack campaigns.
While these findings have exposed the sensitive information of the Malaysian and UAE airline passengers against potential threats, our cybersecurity team will keep an eye on the issue until more details are revealed.
