British Airways check-in vulnerability exposes passenger information
.jpg)
British Airways has put passenger personal information at risk after it was found to be emailing unencrypted links to customers in part of its online check-in e-ticketing process.
Researchers at security firm Wandera said such check-in links could be easily intercepted by attackers, say those lurking on a public Wi-Fi network, and allow malicious actors to view and change the flight booking details and personal information of passengers.
“In an effort to streamline the user experience, passenger details are included in the URL parameters that direct the passenger from the email to the British Airways website where they have logged in automatically so they can view their itinerary and check-in for their flight,” explained Wandera. “The passenger details included in the URL parameters are the booking reference and surname, both of which are exposed because the link is unencrypted.”
Other information that could be exposed by the flaw includes email address, phone number, membership number, first and last name, booking reference, itinerary, flight number, flight times, seat number and baggage allowance.
Wandera’s threat research team discovered the flaw last month after someone accessed BA’s e-ticketing system from its network. The firm has previously discovered similar vulnerabilities affecting airlines such as Southwest, KLM, Air France, Jetstar, Thomas Cook, Vueling, Air Europa and Transavia.
It recommends that airlines adopt encryption throughout their check-in process, require user authentication for steps where personal information could be accessed, utilise one-time time tokens for email links and ensure users have mobile security deployed.
Israel Barak, the chief information security officer at Cybereason, said: "The British Airways vulnerability again sheds light on the difficulty airlines, and all corporations for that matter, are having protecting the backbone of their organisations - customer data.
“This isn't the first vulnerability either, as many as 10 airlines were reportedly investigating a similar vulnerability earlier this year. Kudos to British Airlines for acknowledging the incident and for them working quickly to solve any outstanding issues.
“For the consumer flying with British Airways, or with other carriers, they should be working under the assumption that their personal information has been compromised many times over. “
The news comes after nearly 300 flights were delayed or cancelled at London's Heathrow, Gatwick and City airports when BA faced a major IT outage. And in July, it was fined a record £183 million for GDPR violations.
source itpro
Industry: Cyber Security

Latest Jobs
-
- Cloud Architect- German Speaker
- Hungary
- Upto €48000 per year + bonus + benefits
-
As a Senior Pre-Sales Solutions Architect, you will play a pivotal role in driving our sales success by translating complex technical solutions into compelling proposals that resonate with our clients. You will collaborate closely with our sales teams to understand customer needs, design tailored solutions, and negotiate successful deals. Responsibilities: Solution Design: Develop comprehensive technical solutions that align with customer business objectives and industry best practices. Proposal Development: Create compelling proposals, including requirements gathering questionnaires, presentation materials, and Statements of Work (SOWs). Customer Engagement: Build strong relationships with clients, understanding their technical, business, and commercial requirements. Collaboration: Work closely with sales teams, delivery teams, and third-party partners to ensure successful project execution. Pricing Strategy: Define and deliver pricing strategies that align with customer needs and company objectives. Requirements: Experience in technical pre-sales or sales support roles. Proven track record in designing and delivering successful customer solutions. Strong technical foundation in areas such as VMware, Azure, AWS, cloud computing, and data center technologies. Excellent understanding of sales principles, account management, and negotiation techniques. Ability to explain complex technical concepts clearly and concisely. Experience working in international teams and supporting clients across multiple regions. Fluency in German and English is essential. Benefits: Competitive salary and benefits package Opportunity to work on challenging and rewarding projects Collaborative and supportive work environment Potential for career growth and advancement Please note that this role is focused on supporting German clients, but will also involve global client support as needed.
-
- Director Cyber Security Consulting Medical / Biotech / Biopharma. United Kingdom
- United Kingdom
- Generous salary, uncapped bonus, travel and usual benefits.
-
CH8431 Director Cyber Security Consulting Medical / Biotech / Biopharma. United Kingdom Looking to make Security Partner within 2-3 years? Do you have current experience selling / delivering cyber consulting & advisory services into Medical / Biotech / Biopharma? If so, we would like to speak with you. Apply today for a discreet conversation. This is a UK based opportunity. Current Cyber security consulting experience is essential, as is a network into the Pharmaceutical / Healthcare industry. Package- Generous salary, uncapped bonus, travel and usual benefits. 07884666351 | chris.holt@dclsearch.com
-
- Director Cyber Security Consulting Pharmaceutical / Healthcare. United Kingdom
- United Kingdom
- Generous salary, uncapped bonus, travel and usual benefits.
-
CH8430 Director Cyber Security Consulting Pharmaceutical / Healthcare. United Kingdom Looking to make Security Partner within 2-3 years? Do you have current experience selling / delivering cyber consulting & advisory services into Pharmaceutical / Healthcare? If so, we would like to speak with you. Apply today for a discreet conversation. This is a UK based opportunity. Current Cyber security consulting experience is essential, as is a network into the Pharmaceutical / Healthcare industry. Package- Generous salary, uncapped bonus, travel and usual benefits. 07884666351 | chris.holt@dclsearch.com
-
- Privileged Access Management (PAM) Specialist
- Germany
- upto €700 per day
-
We are looking for a Privileged Access Management (PAM) specialist to help us redesign our customer's administration environment and implement a PAM tool. The project is divided into two phases: a rough concept phase and a detailed concept phase. We need someone with deep knowledge of ITIL V4, product provisioning, automation, and standardization, as well as good knowledge of the cloud environment, Enterprise Vault, requirements documentation, and analysis. We also need someone with strong communication and team skills Ideally you will have experience with CyberArk, we do require someone who is fluent in German for this contract