American Airlines has admitted that personal passenger data may have been stolen by cybercriminals in a sophisticated phishing scam that targeted the Dallas Fort Worth-based carrier’s own employees.
In a statement, the airline did not disclose the extent of the data breach but a spokesperson said that there was, so far, no evidence that the data had been misused.
“American Airlines is aware of a phishing campaign that led to the unauthorized access to a limited number of team member mailboxes,” the airline said in a statement first provided to FOX affiliated news stations.
Phishing scams typically involve fraudulent emails that are designed to get the victim to click on a link that will then infect the computer system with malware. The link may also redirect victims to a reputable-looking website where they unwittingly hand over personal data to criminals.
American Airlines said it was “currently implementing additional technical safeguards to prevent a similar incident from occurring in the future.” A spokesperson added that “data security is of the utmost importance, and we offered customers and team members precautionary support.”
Lawyers acting on behalf of American Airlines are currently pursuing a group of online criminals who are using fake websites designed to appear as if they belong to the carrier in order to defraud unsuspecting customers.
A lawsuit filed on behalf of AA is seeking to gain control on a slew of websites that, at first glance, are designed to appear to belong to the airline.
The website addresses, which include misspellings like AmericaknAirlines.com and AmericanAirlinese.com, are often used to send fraudulent phishing emails that are designed to look like they were sent from the genuine American Airlines.
Victims are often presented with fake flight change email or booking confirmation email that uses American Airlines logos to lure victims into clicking a link that sends users through to a website containing malware that could then infect the victim’s computer or smartphone and then steal their personal data.
