vernonc

So it appears that 20K approx accounts were hacked. Assuming this number is correct. OR as AC says, may or may not have been hacked. More important is it seems that everything except credit cards may have been hacked. This includes Name, DOB, email address, phone number, Nexus/passport info, etc. See below. Just fricking awesome.

What information may have been accessed?
Basic profile data stored on the Air Canada mobile App account includes your name, email address, and telephone number.

Information that you may have added to your profile includes: Aeroplan number, Passport number, NEXUS number, Known Traveler Number, gender, birthdate, nationality, passport expiration date, passport country of issuance and country of residence.

dr_torch

I have the same issue as you. I reset the password, but I cannot get into the Flight Pass App or the Air Canada app.
The Aeroplan app tells me that they are having technical issues

It's a good job I don't have to book a flight today!

Shareholder

skybluesea

Well, AC used the word "confident" in their notice about how many affected.

Rather, AC did NOT use the word "certain", which would provide far more clarity.

btw...while "confident" means "self-assured", but since AC pledges all over the place to take care of the data entrusted to them, how can any customers be confident about AC promises going forward???

I agree with @Stranger, AC needs feet held to the fire either via the Privacy Commissioner of Canada, or even via the courts, if applicable.

Bohemian1

Great.

Not only was/is it insecure, it doesn't scale either. Simply brilliant.

I'm very happy that whoever designed this and thought it was good is not on any of my teams.

As an aside, I wonder how their GDPR audit is going ...

songsc

I wish AC can provide more info about what part of the system got accessed and what exactly did this unauthorized access happen.

Someone guessed the password and private keys to database containing user info? Someone found a way to compromise the normal authentication flow of the app? Someone somehow guessed the password of 20K users?

cvkyyz

It's a good reminder to check if your account has been part of a larger hack as well (LinkedIn or Adobe are two of the big ones). These guys aren't "hacking" AC, they're just running massive login lists against the app to see who still uses the same password on multiple sites. https://haveibeenpwned.com/ is a good place to check.

That being said, it's on AC to monitor their web traffic for this sort of high volume login attack. I got an email from PC Optimum this week for the same issue, so I'm guessing these guys were taking a run at a bunch of retailers.

Bohemian1

Another reason to ensure that EVERY password is unique. And use a password manager if you need to.

Of course, all of us here do this already, but I also still know lots of 'IT professionals' who rely on the re-use of the same, arguably complex passwords across multiple accounts.

BarrieTravelGuy

I got an email saying my account was one of the breached accounts and they they have my passport, nexus, personal information excluding credit cards. I will be making a complaint... at the very least Air Canada should offer to pay for credit score/report monitoring.

24left

Geoflying

Here is a link to how to proceed with making a complaint to the office of the Privacy Commissioner - https://www.priv.gc.ca/en/report-a-c...-under-pipeda/

Hope this is helpful information for those who have had their accounts breached - it took me a while to find it so my intent is to save you that hassle

Bohemian1

They just might do that. But be aware that this is just a bandaid at best.

Brian Krebs has this good piece on why credit monitoring is less than effective. This Q&A was was triggered by the Equifax breach, but it's still good info to have.

Sadly credit security freezes are not available in Canada because the banks simply don't want to do it.

Genetk44

BarrieTravelGuy

I just called the phone number that was in my email from Air Canada telling me I had one of the breached accounts. The person was very misleading - told me the only thing they had was my name, phone number and email. I said what about passport, nexus, etc? He said "That was all encrypted... nothing they can do with it?. When I asked why they said the passport info was low risk - why would it be any risk if they can't get the info?? Then he started to back track and said that yes - if your profile had Aeroplan number, Passport number, NEXUS number, Known Traveler Number, gender, birth date, nationality, passport expiration date, passport country of issuance and country of residence - then they did get that info. I was told to change my aeroplan password immediately as someone may take my points. ... - it didn't say anything about that in the email. Who is running this thing??

vernonc

This. Where is the offer for credit report monitoring ?