"Action needed - unauthorized account access"
Jan 21, 2015, 9:16 am
#16
Join Date: Sep 2002
Location: Blue Ridge, GA
Posts: 5,509
A spokeswoman for Southwest Airlines doesn’t report seeing any suspicious work of hackers
Jan 21, 2015, 10:36 am
#17
Join Date: Jun 2013
Location: CMH usually
Programs: AA PLT, WN A+ (and Sometimes CP) | Hilton Diamond | Avis Preferred | National Car Exec
Posts: 414
Maybe the spokesperson themselves did not personally view the activity 
Anyhow, sounds like a password change around the airlines/hotel program logins is in order just to be sure...
Anyhow, sounds like a password change around the airlines/hotel program logins is in order just to be sure...
Jan 21, 2015, 11:06 am
#18
Join Date: Apr 2014
Location: “I work for Southwest, but the views expressed are my own and do not necessarily represent those of Southwest.”
Programs: WN
Posts: 22
How do we know anything anyone on this board says is true?
Southwest does not like its employees posting here and so this person is not going to say anything that points to who they are. I think we should be happy that an employee is posting and either accept what they say or not as we choose.
Southwest does not like its employees posting here and so this person is not going to say anything that points to who they are. I think we should be happy that an employee is posting and either accept what they say or not as we choose.
Jan 21, 2015, 12:45 pm
#19
Company Representative, Southwest
Join Date: Jun 2014
Location: Dallas, TX
Programs: Southwest Airlines Rapid Rewards
Posts: 13
Hi All,
Southwest did recently identify a small number of Rapid Rewards accounts that appear to have been accessed without Customer consent. To protect these accounts, we temporarily suspended the passwords and proactively sent Customer notifications requesting a password reset.
We apologize to Members for any inconvenience this may have caused.
Rob Hahn
Southwest Airlines
Southwest did recently identify a small number of Rapid Rewards accounts that appear to have been accessed without Customer consent. To protect these accounts, we temporarily suspended the passwords and proactively sent Customer notifications requesting a password reset.
We apologize to Members for any inconvenience this may have caused.
Rob Hahn
Southwest Airlines
Jan 21, 2015, 3:20 pm
#20
Join Date: Oct 2001
Programs: LTP, PP
Posts: 8,698
Thanks for the confirmation.
Did you ever consider sending out a similar email to A List + customers telling them it was necessary to strengthen / change their password in order to access the free WI-FI benefit in flight? Drove some people nuts unnecessarily....
Did you ever consider sending out a similar email to A List + customers telling them it was necessary to strengthen / change their password in order to access the free WI-FI benefit in flight? Drove some people nuts unnecessarily....
Jan 21, 2015, 3:50 pm
#21
Original Poster
Join Date: Mar 2011
Posts: 6,286
Hi All,
Southwest did recently identify a small number of Rapid Rewards accounts that appear to have been accessed without Customer consent. To protect these accounts, we temporarily suspended the passwords and proactively sent Customer notifications requesting a password reset.
We apologize to Members for any inconvenience this may have caused.
Rob Hahn
Southwest Airlines
Southwest did recently identify a small number of Rapid Rewards accounts that appear to have been accessed without Customer consent. To protect these accounts, we temporarily suspended the passwords and proactively sent Customer notifications requesting a password reset.
We apologize to Members for any inconvenience this may have caused.
Rob Hahn
Southwest Airlines
Just a thought: It would avoid confusion and suspicion of the validity of these messages if they were personalized to the customer's name and account number (like the Rapid Rewards Reports are).
Jan 21, 2015, 10:55 pm
#22
Join Date: Jul 2013
Posts: 5,813
I for one will never accept as official any such notification unless I can confirm it independantly.
Jan 21, 2015, 11:16 pm
#23
Join Date: Feb 2004
Location: USA
Programs: AC SE100K, F9 100k, NK Gold, UA *S, Hyatt Glob, Bonvoy Titanium
Posts: 5,194
I would believe an email like this only if:
1) It contained ZERO clickable links and purposely told the users to use the browser of choice to access southwest.com
2) It contained a 800# (best case-Southwest's main reservations line) and reference # where the passenger could call to confirm the validity of the email.
Odds are, the passwords were stolen. not hacked. Southwestwifi (especially A-list preferred free wifi) has not always used SSL for logins. Therefore ANYONE on the flight could obtain a list of logins/passwords using a free program called a network traffic sniffer. This will also give them every single FTP username/password used, an login/form data for other unsecure (http port 80) sites.
1) It contained ZERO clickable links and purposely told the users to use the browser of choice to access southwest.com
2) It contained a 800# (best case-Southwest's main reservations line) and reference # where the passenger could call to confirm the validity of the email.
Odds are, the passwords were stolen. not hacked. Southwestwifi (especially A-list preferred free wifi) has not always used SSL for logins. Therefore ANYONE on the flight could obtain a list of logins/passwords using a free program called a network traffic sniffer. This will also give them every single FTP username/password used, an login/form data for other unsecure (http port 80) sites.
Jan 22, 2015, 2:18 am
#24
Original Poster
Join Date: Mar 2011
Posts: 6,286
expert7700's points are very valid as well, and represent "best practices" for this type of message. Another red flag for me was the clickable link; although it did seem to call up southwest.com, I manually entered the url on an incognito window in Chrome just to be sure. A large call-to-action that included the 800 number / reference number combo would be great as well, but I suspect (and the reason I didn't call Southwest first was) that doing so would likely be a lengthy and frustrating process.
Jan 22, 2015, 7:32 pm
#25
Join Date: May 2006
Location: SF Bay Area (East Bay), CA, USA
Programs: WN CP/A-List
Posts: 151
I got the same message in my email. I didn't see it until today. I did not click on anything from the email, but opened a new window in my browser to check my SW account. Sure enough, my account had been locked. I tried to change the password, but the answers to my security questions (which were correct) still wouldn't let me in. I had to call SW. They verified my information, then sent me an email link to reset my password.
I do not have very many points in my account, the bulk of our points are in mr. drooley's account. His account was not affected. I changed and strengthened the passwords for both accounts.
I do not have very many points in my account, the bulk of our points are in mr. drooley's account. His account was not affected. I changed and strengthened the passwords for both accounts.
Jan 23, 2015, 8:41 am
#26
FlyerTalk Evangelist
Join Date: Jun 2003
Location: DEN
Programs: UA MM Plat; AA MM Gold; HHonors Diamond
Posts: 15,866
I received a very similar email from United. I ignored it because I don't fly United very often if at all. If I need to fly them I'll call their customer service and inquire.
You can always call Southwest Customer Service and inquire, but I wouldn't reply to the email or use any links in it.
You can always call Southwest Customer Service and inquire, but I wouldn't reply to the email or use any links in it.
http://www.flyertalk.com/forum/unite...ec-2014-a.html
Last edited by Bonehead; Jan 23, 2015 at 8:47 am