Indonesian Lion Group’s Malaysian subsidiary Malindo Air said two former employees of its e-commerce contractor were responsible for its passenger data breach.
Malindo Air made the breach public last week after Moscow-based cybersecurity firm Kaspersky Lab said in a report that the details of around 30 million passengers of Malindo and another Lion Group subsidiary, Thai Lion Air, were posted in online forums.
Kaspersky said parts of the leaked databases were up for sale on the dark web.
Malindo Air said in a statement that two former employees of e-commerce services provider GoQuo (M) Sdn Bhd in their development centre in India “improperly accessed and stole the personal data of our customers”.
The airline said the data breach had since been contained and the matter has been reported to the police in Malaysia and India.
Malindo Air said the breach was not related to the security of cloud service provider Amazon Web Services’ data architecture, and none of the customers’ payment details was compromised. --Reuters