About 580,000 frequent fliers' data breached, says Singapore Airlines

Around 580,000 privilege fliers, KrisFlyer and PPS members, have been affected by a data breach, Singapore Airlines (SIA) has said.

The data breach involves the passenger service system servers of SITA, an air transport information technology company, according to Channel News Asia report.

"While SIA is not a customer of the SITA PSS, this breach of the SITA PSS server has affected some KrisFlyer and PPS members," the national carrier said on Thursday.

SIA added that this data breach specifically does not involve KrisFlyer and PPS member passwords, credit card information and other customer data such as itineraries, reservations, ticketing, passport numbers and email addresses.

Such information is not shared with other Star Alliance member airlines for this data transfer, the airline said.

All Star Alliance member airlines provide a restricted set of frequent flyer programme data to the alliance, which is then sent on to other member airlines to reside in their respective passenger service systems.

SIA said this data transfer is necessary to enable verification of the membership tier status, and to accord to member airlines' customers the relevant benefits while travelling.

One of the Star Alliance member airlines is a SITA PSS customer. As a result, SITA has access to the restricted set of frequent flyer programme data for all 26 Star Alliance member airlines including Singapore Airlines.

"The information involved is limited to the membership number and tier status and, in some cases, membership name, as this is the full extent of the frequent flyer data that Singapore Airlines shares with other Star Alliance member airlines for this data transfer," said SIA.

SIA said none of its IT systems have been affected by the breach and that they are reaching out to all KrisFlyer and PPS members to inform them about the incident. "The protection of our customers' personal data is of utmost importance to Singapore Airlines, and we sincerely regret the incident and apologise for the inconvenience caused."

SITA confirmed in a separate statement that it was the "victim of a cyber-attack" which led to the data security incident.

After confirming the seriousness of the incident on February 24, SITA said it took immediate action to contact the affected SITA passenger service system customers and all related organisations.

"We recognise that the COVID-19 pandemic has raised concerns about security threats, and, at the same time, cyber-criminals have become more sophisticated and active. This was a highly sophisticated attack," the Channel quoted the company as saying.

SITA added that the matter remains under continued investigation by its security incident response team with the support of "leading external experts in cyber-security".