AirAsia Thailand passenger data allegedly leaked after ransomware attack

AirAsia group allegedly fell victim to a ransomware attack that leaked the personal data of five million passengers and all staff of AirAsia Thailand, AirAsia Malaysia, and AirAsia Indonesia.

The Daixin Team, a ransomware and data extortion group, allegedly leaked the data after the airline refused to pay a ransom. On Monday, the Daixin Team was the focus of a cybersecurity alert jointly released by the US Federal Bureau of Investigation (FBI) and Cybersecurity and Infrastructure Security Agency (CISA).

DataBreaches reported that the ransomware attack took place on November 11 and November 12, 2022. The airline reportedly responded to Daixin Team through a chat when the hackers sent a data sample.

DataBreaches allege that Daixin leaked two .csv files containing the personal data of five million passengers and staff. The first included passenger data including passenger ID, full name (full, middle, last), booking ID, and cost of the ticket.

Meanwhile, the second .csv file allegedly leaked contained employee data containing photos, secret questions, secret answers, birth city, birth state, birth country, nationality, and employment details.

A Daixin spokesperson said that AirAsia responded to the attack and “asked in great detail how we would delete their data in case of payment.” The spokesperson said that AirAsia did not try and negotiate the amount, indicating that they never intended on paying the ransom for their data.

“Usually everyone wants to negotiate a smaller amount,” said the spokesperson.

Daixin allegedly said they wouldn’t bother launching a second attack on AirAsia because they were “irritated” by the “poor organisation” of the company.

AirAsia Group is not the first air carrier in the region to fall victim to data breach attacks. Malaysia Airlines disclosed data security incidents in both 2020 and 2021.

AirAsia has not made a public statement about the Daixin Team’s alleged ransomware attack.

AirAsia Group is allegedly hit by Daixin ransomware group 5M UNIQUE Passengers personal data, All employees personal data leaked@ransomwaremap pic.twitter.com/M9bg22S5QW

— Soufiane Tahiri (@S0ufi4n3) November 20, 2022