About 580,000 Singapore Airlines KrisFlyer And PPS Members Affected By Data Security Breach

SINGAPORE: About 580,000 KrisFlyer and PPS members have been affected by a data security breach, Singapore Airlines (SIA) said on Thursday (Mar 4).

The data breach involves the passenger service system servers of SITA, an air transport information technology company.

“While SIA is not a customer of the SITA PSS, this breach of the SITA PSS server has affected some KrisFlyer and PPS members,” said the national carrier.

All Star Alliance member airlines provide a restricted set of frequent flyer programme data to the alliance, which is then sent on to other member airlines to reside in their respective passenger service systems.

SIA said this data transfer is necessary to enable verification of the membership tier status, and to accord to member airlines’ customers the relevant benefits while travelling.

One of the Star Alliance member airlines is a SITA PSS customer. As a result, SITA has access to the restricted set of frequent flyer programme data for all 26 Star Alliance member airlines including Singapore Airlines.

“The information involved is limited to the membership number and tier status and, in some cases, membership name, as this is the full extent of the frequent flyer data that Singapore Airlines shares with other Star Alliance member airlines for this data transfer,” said SIA.

Also Read: The DNC Registry Singapore: 5 Things You Must Know

SIA added that this data breach specifically does not involve KrisFlyer and PPS member passwords, credit card information and other customer data such as itineraries, reservations, ticketing, passport numbers and email addresses.

Such information is not shared with other Star Alliance member airlines for this data transfer, said the airline.

SIA said none of its IT systems have been affected by the breach and that they are reaching out to all KrisFlyer and PPS members to inform them about the incident.

“The protection of our customers’ personal data is of utmost importance to Singapore Airlines, and we sincerely regret the incident and apologise for the inconvenience caused.”

“HIGHLY SOPHISTICATED ATTACK”

SITA confirmed in a separate statement that it was the “victim of a cyber-attack” which led to the data security incident.

After confirming the seriousness of the incident on Feb 24, SITA said it took immediate action to contact the affected SITA passenger service system customers and all related organisations.

“We recognise that the COVID-19 pandemic has raised concerns about security threats, and, at the same time, cyber-criminals have become more sophisticated and active. This was a highly sophisticated attack,” it said.

Also Read: How To Comply With PDPA: A Checklist For Businesses

SITA added that the matter remains under continued investigation by its security incident response team with the support of “leading external experts in cyber-security”.