Flight Tracker Flightradar24 Hit by Data Breach
21.6.2018 securityweek  CyberCrime

Flightradar24, a highly popular flight tracking service based in Sweden, has instructed some users to change their passwords after detecting a breach on one of the company’s servers.

Earlier this week, some Flightradar24 users started receiving emails alerting them of a security breach in which email addresses and password hashes associated with accounts registered prior to March 16, 2016, may have been compromised.

Some of the individuals who received the notification complained that the emails looked like phishing attempts, especially since the company had not mentioned the incident on its website or social media channels. It has however confirmed to users who inquired via social media and the company’s forum that the emails are legitimate.

In response to posts on the Flightradar24.com forum, a company representative highlighted that no personal information was compromised, and noted that payment information is not stored on its systems.

Flightradar24 said it was confident that the incident had been contained after the targeted server was “promptly” shut down after the intrusion was detected.

The company did not specify which hashing algorithm was used for the exposed passwords, but noted that the compromised system had been retired and used an older algorithm that allows for the hashes to be cracked. Affected users’ passwords have been reset as a result. The flight tracker says it has been using a more secure hashing algorithm since 2016.

The company has not said how many users are impacted – it’s notification only mentions that the incident affects a “small subset of Flightradar24 users.” However, considering that the service is said to have more than 40 million users per month and its mobile applications are among the most installed apps on Google Play and the Apple App Store, even a “small subset” could be a significant number.

FlightRadar24 says it has notified the Swedish Data Protection Authority in order to comply with the EU’s General Data Protection Regulation (GDPR).