Breaches and incidents
Adventure Inc. (skyticket): three intrusions, about 14.64M customer records leaked, later bank and card data
Adventure said attackers abused some skyticket admin functions (2 to 4 Oct) to reach other servers and cloud data, leaking about 14.64M records (names...
- Disclosed
- Verification
- Checked against a primary source
What happened
- Adventure said attackers abused some skyticket admin functions (2 to 4 Oct) to reach other servers and cloud data, leaking about 14.64M records (names incl. passport spelling, DOB, email, phone, address, hashed passwords for about 4.13M); separately a business-management system vulnerability (20 Sep) exposed 17,780 records incl. refund bank accounts, and bus booking pages viewable without login exposed about 12,000 bookings.
- Root cause per the company: admin function misuse, an unpatched business-system vulnerability, and missing authentication on bus booking pages; later reports (16 and 30 Oct) found an undeleted 2017 to 2018 payment log with card numbers for up to 6,140 people (encryption keys also taken), and an old cloud database backup kept after it was no longer needed, read with stolen credentials, exposing 32,341 bank accounts and about 936,000 masked card records.
- No attacker named.
- Access routes were blocked, stored-card payments stopped on 7 Oct, the PPC notified, payment processor and Benefit One informed; the company corrected its first report’s “no card numbers” statement.