With the recent rise of cyber threats targeting the aviation industry, particularly from a group known as Scattered Spider, it's more crucial than ever to understand how these attacks could impact you. Recent breaches at WestJet and Hawaiian Airlines highlight vulnerabilities in security protocols, specifically exploiting MFA reset mechanisms and employing sophisticated social engineering tactics. This blog dives into the specifics of these threats, the data compromised, and what steps you can take to safeguard your information.
What Datapoints Were Leaked?
Recent attacks by the Scattered Spider group on airlines like WestJet and Hawaiian Airlines have exposed a trove of sensitive customer information. Here’s what we know about the data at risk:
How Attackers Got In
Scattered Spider used a mix of MFA (Multi-Factor Authentication) reset mechanism exploits and social engineering to bypass security. Instead of hacking passwords directly, they tricked airline employees into resetting MFA controls, often by posing as legitimate IT staff or executives. Once past these barriers, attackers had access to backend systems holding passenger data.
Email addresses and phone numbers – increasing risk of phishing and scam attempts.
Loyalty program details – including account numbers and, in some cases, travel history.
Payment card data – partial details in some cases, with a risk of financial fraud.
Booking information – flight dates, destinations, and even special assistance requests.
Sensitive note: Even if full credit card numbers weren’t leaked, paired data (like names, emails, and last four digits) can be used in targeted scams.
The Real Danger
What makes these breaches more severe is how attackers combined technical exploits with psychological manipulation. By exploiting trust, they gained deep access—far beyond just a password.
If you’re a frequent flyer or have booked with these airlines in the past year, your personal and financial details could be circulating among cybercriminals. And if you reuse passwords or security questions, the risk multiplies.
Should You Be Worried?
Data breaches in the airline industry aren’t just a headline or something that happens to “other people.” If you’ve booked flights, joined a frequent flyer program, or even just checked your flight status online, your data could be in the crosshairs.
Why Airline Breaches Are a Real Concern
When hackers like Scattered Spider break into airline databases, they aren’t after empty seats—they’re hunting for personal information. Here’s what’s at stake:
Identity Theft: Stolen names, passport numbers, and birth dates can be used to open fraudulent accounts or commit crimes in your name.
Financial Fraud: If payment details are compromised, criminals can make unauthorized purchases or drain accounts.
Phishing Attacks: Once cybercriminals have your email or phone number, they can craft convincing fake messages that look like they’re from your airline. One wrong click, and you could hand over even more sensitive information.
Social Engineering: Scattered Spider is notorious for tricking airline employees into giving up access. They use a mix of phone calls, fake identities, and urgent-sounding requests to get the keys to the kingdom.
Immediate Impact on Airline Customers
If you’ve flown with one of the affected airlines, here’s what you might notice:
Unexpected emails or texts asking you to “verify your identity” or “confirm your booking.”
Sudden, unexplained charges on your credit card.
Your frequent flyer miles mysteriously disappearing or being redeemed without your knowledge.
For many, it’s not just about losing money—it’s about losing peace of mind.
The Bigger Picture: Why It Matters
You might think, “I’m just one person; why would hackers care about my data?” The truth is, every piece of information is valuable on the dark web. Airline data often includes detailed travel histories, which can be leveraged for targeted scams or even blackmail.
Cloaked helps address these risks by creating virtual identities and secure contact details, so even if a breach occurs, your real information stays protected. It’s one way to make yourself a smaller target in a world where breaches are becoming more frequent and more sophisticated.
What Should Be Your Next Steps?
A data breach hits hard—especially when it happens with an airline holding your passport, payment, and travel details. Acting fast can make all the difference. Here’s a clear, actionable playbook to help you limit the damage and keep your identity safe.
1. Change Passwords Without Delay
Don’t wait. Change passwords for your airline account and any other accounts using the same or similar credentials. Go for strong, unique combinations—think longer phrases with a mix of letters, numbers, and symbols.
Enable multi-factor authentication (MFA): MFA is crucial, but recent attacks like the Scattered Spider breach show that hackers sometimes exploit weak MFA reset mechanisms. If your airline offers app-based MFA or physical security keys, opt for those over SMS or email-based methods.
Check password managers: Use a reliable password manager to generate and store complex passwords. It’s safer than sticky notes or recycled passwords.
2. Monitor Financial Accounts and Credit Reports
Breached data often ends up for sale on the dark web, and airline attacks can expose credit card and ID details.
Review bank and credit card statements weekly. Look for any transaction you don’t recognize, no matter how small.
Set up transaction alerts. Most banks let you get notifications for every purchase or withdrawal.
Request credit reports regularly. Watch for new accounts or inquiries you didn’t authorize.
3. Watch for Phishing and Social Engineering
Scammers move quickly after a breach, often using your stolen info to craft convincing phishing emails or calls.
Be skeptical of any communication claiming to be from your airline. Don’t click links or download attachments from unexpected emails or texts.
Double-check sender addresses—look for slight misspellings or extra characters.
Never share personal info (like login codes or card numbers) unless you’ve confirmed the request through a verified channel.
4. Secure Your Frequent Flyer and Loyalty Accounts
Airline points are valuable and often targeted after a breach.
Reset passwords for all travel-related accounts.
Check account activity for unauthorized redemptions or changes.
Update contact information to keep recovery options current.
5. Limit Data Exposure in the Future
Consider minimizing the amount of data you share with airlines and travel services.
Don’t save payment info unless you must. Delete old cards and unnecessary profile details.
Use masked emails and phone numbers for travel bookings. Cloaked, for example, lets you create one-time-use contact info, shielding your real data from future leaks.
6. Stay Informed
Sign up for breach alerts (like those from Have I Been Pwned) to know when your email or details appear in a data dump.
Follow the airline’s official updates for guidance and compensation options after a breach.
7. Report and Document
If you spot fraudulent activity, act quickly.
Contact your bank or card provider immediately to freeze or replace compromised accounts.
File a report with the airline and local authorities if identity theft occurs.
Keep records of all correspondence and actions you take.
By sticking to these steps, you put yourself in a stronger position to control the fallout from an airline data breach. Small actions, taken quickly, can stop a bad situation from spiraling.
Cloaked FAQs Accordion
Frequently Asked Questions
Cloaked is a privacy-first tool that lets you create secure aliases for emails, phone numbers, and more—shielding your real identity online. With Cloaked, your personal info stays protected from breaches, scams, and tracking.
Look for urgent messages, unfamiliar links, or strange sender addresses. With Cloaked aliases, it’s easier to identify which site may have leaked your contact details and ignore suspicious communications.
Yes. If a Cloaked alias starts receiving spam, you can pause, delete, or rotate it. This eliminates the need to change your real email or phone number.
They do different jobs. VPNs protect browsing. Password managers secure logins. Cloaked protects your real identity at the contact level—emails, phones, and personal identifiers.
Definitely. Use Cloaked aliases to avoid spam and limit exposure to companies that may mishandle or leak your data.
At Cloaked, we believe the best way to protect your personal information is to keep it private before it ever gets out. That’s why we help you remove your data from people-search sites that expose your home address, phone number, SSN, and other personal details. And to keep your info private going forward, Cloaked lets you create unique, secure emails and phone numbers with one click - so you sign up for new experiences without giving away your real info. With Cloaked, your privacy isn’t a setting - it’s the default. Take back control of your personal data with thousands of Cloaked users.
*Disclaimer: You agree not to use any aspect of the Cloaked Services for FCRA purposes.
