Criticism of security breach at KLM and Air France: customer data easy to intercept

(Jarretera/Shutterstock.com)

KLM recently had a problem with the security of customer data. Research by NOS showed that personal information from customers, such as telephone numbers, email addresses and sometimes even passport details, could easily be collected by people who did not have permission to do so. This problem not only affected KLM customers, but also those of Air France.

The leak was discovered because data could easily be collected using a special script. In this way, more than 900 active links could be found in a short time, often containing personal information. This type of data can be misused, for example to create fake travel documents or targeted phishing attacks.

One of the causes of this leak was that the hyperlinks in KLM's text messages were extra short, making them easier to guess. By randomly entering links, a hacker could eventually gain access to valid links.

A security researcher noted that the codes were too short and there were too many working codes in circulation. KLM quickly resolved this problem after being informed by NOS. Customers must now first log in to the My Travel environment of KLM or Air France to use the links.

It is not clear how many customers were at risk from this breach. KLM did not comment on the calculations about how often a valid link could be found. The company emphasizes that they take the privacy of their passengers seriously and have an advanced security policy.

Another security expert indicates that the problem is due to a lack of care on the part of KLM. Although KLM claims that their systems raised the alarm due to the investigation, it remains unclear whether the leak has been exploited before.

According to a privacy advisor, it is often difficult to determine whether there is abuse and that companies are not always transparent about this. KLM has not provided further details on how they can rule out other misuse of the leak.

Source: NOS