Air Canada Mobile App Users Affected By Data Breach

Air Canada informed today 20,000 of its mobile app users that information listed under their profile may have been accessed without authorization.

Between August 22-24, the company noticed unusual login activity and responded by stopping the attempts. To protect customer data, Air Canada locked all its 1.7 million mobile app accounts.

Those who want to reactivate their account are advised to follow the instructions on the app the next time they log in.

However, people complaining on Twitter about the potential intrusion also complain about not being able to reset their password because the app keeps crashing.

Same here, couldn't change my password on the app, had to update the app now it just crashes every time I try to change the password, same old story with @AirCanada if they can find a way waste hours of my life with their incompetence, they will.

— DanInTO (@DannyinTO) August 29, 2018

An intruder gaining access to the profile of an Air Canada mobile app user could see at least the owner's name, email address, and telephone number.

Additional data a user may add to their profile includes their number for the  Aeroplan loyalty program, Passport number, NEXUS number, Known Traveler Number, gender, birthdate, nationality, passport expiration date, passport country of issuance and country of residence.

Umm, WTH @AirCanada? What am I supposed to do now that you've identified my account was hacked?! pic.twitter.com/u5DNZOx8H4

— Deepak Anand (@_deepakanand) August 29, 2018

Card data and official documents are safe

In a statement about the breach, Air Canada says that credit card data remains unaffected and that no aircanada.com accounts were affected as they are not connected to the mobile app.

"Credit cards that are saved to your profile are encrypted and stored in compliance with security standards set by the payment card industry or PCI standards," the statement reads.

Those worried about their passport information should know that the risk of falling victim to identity theft is low.

According to the Canadian government website, the information available in a passport is not sufficient to issue the document to another person. Additional identification is necessary to confirm the personal details.

As an added precaution, Air Canada recommends its customers to regularly review their financial transactions and contact their financial service provider if they notice any unusual activity in their bank account.

Test every layer before attackers do

Security teams log 54% of successful attacks and alert on just 14%. The rest move through your environment unseen.

The Picus whitepaper shows how breach and attack simulation tests your SIEM and EDR rules so threats stop slipping by detection.

Get the whitepaper