Stolen data experts at HaveIBeenPwned have analysed the published material and confirmed it contains people’s email addresses, phone numbers, addresses, licence plate numbers, purchasing history and browsing device data.
Cyber-security expert Kevin Beaumont warned those affected to be on high alert for other forms of scam and hack – especially high profile or wealthy individuals.
“The data includes both historical locations and planned future travel, so individuals sensitive to their movements being known may need to take precautions,” he said.
“People should be alert to scammers reusing the data and so knowing details such as phone numbers and car registration numbers,” he added.
Law enforcement organisations including the UK’s National Crime Agency have long advised victims of extortion attacks not to pay criminal ransoms as it fuels the hacker ecosystem.
MAG says it is working with the authorities and specialist advisors and says passengers’ physical safety has not be at risk in the airports.
Unusually, the cyber criminals’ website where the MAG data is available is hosted on the clear internet and not on the dark net like most other so-called hacker “leak sites”.
This makes the data easier to access, increasing the risk to victims of MAG and the other companies the gang has breached in recent months.
As well as posting the stolen data, the hackers boasted about how they breached each victim using the same method each time – exploiting weaknesses in how companies store their digital keys for internal networks.
