Some links to products and partners on this website will earn an affiliate commission.
News is slowly filtering out of a substantial personal data breach affecting both the various Star Alliance and Oneworld airlines, and in particular data relating to members of their airlines’ frequent flyer programmes.
It appears that certain Star Alliance and Oneworld member airlines make use of SITA, a Cloud computing business that holds personal data to enable easy verification of frequent flyer status between Oneworld/Star Alliance members. In short, SITA’s databases have been compromised, leading to the exposure of the following information for certain members of loyalty schemes for the airlines in Oneworld and Star Alliance members:
- Membership number
- Tier status
- Membership name.
Don’t Panic
The data breach has not led to the release of passwords, credit card information, or any other customer data such as email addresses.
While potentially more widespread, this data breach is substantially less serious than the recent British Airways issue, which even led to some credit card information being released.
However, check your emails as the various Oneworld and Star Alliance member airlines have, in accordance with their regulatory obligations, begun to email loyalty scheme members. If you receive an email sating your data has been compromised, you should take the necessary steps recommended to secure your information.
At a time when personal data breaches are being treated with increasing severity, and airlines are having a hard time of it regardless, this is clearly bad news for a number of airlines looking to restore customer confidence. However, it’s reassuring to see a number of such airlines dealing with the matter swiftly, openly and honestly.
It’s not yet clear to us if other airline loyalty alliances – such as Skyteam – have been affected. We will update this post should any more information come to light.
I received the following email from Miles & More Lufthansa
MaM NPB LH
Dear Mr. XXXXXXX,
Between 21.1. and 11.2.2021, a data breach occurred at a service provider of one of our Star Alliance partners. The incident involved hackers penetrating a booking system and accessing customer data from Star Alliance partners.
The data in question relates exclusively to service card numbers, status level and in some cases names. Unfortunately, your customer data is also affected. You can rest assured, however, that no passwords, email addresses or other personal customer data were stolen in the incident.
Transparency is a top priority for us at Miles & More. That is why we are hereby informing you about the incident, although it took place outside the Lufthansa Group. There is no need for you to take any action in this matter.
Yours sincerely,
Your Miles & More Service Team
I’m not quite sure what ” Unfortunately, your customer data is also affected. ” means as the preceding sentence specifies membership number, tier level and possibly name … ???
I think the “also” is superfluous (this is probably a rapid German translation to get the email out). I believe what they mean by “also” is you, along with others, have been affected. However, the data they have of yours will be limited to” service card numbers, status level and in some cases names”.
So I really wouldn’t worry, but I would go in and just check your M&M account (as I’m sure you have). Of course there’s not much sense in changing your password as that won’t actually change the correctness of the info the hackers hold… but maybe do it anyway!