Frontier Airlines Likely Breached

Posted by 999900000999 16 hours ago

Counter203Comment78OpenOriginal

Comments

Comment by CSSer 15 hours ago

It seems early to speculate, but if this is related to the massive uptick in CVEs we've been seeing recently it feels like we're actively witnessing a corporate reckoning around security posture the likes of which has never occurred.

Comment by charlieyu1 13 hours ago

Someone found a vulnerability in the system of Hong Kong Airlines that let the user to see the details of another passenger by changing a few characters in the URL. He reported the issue to the airlines. Then he was prosecuted and found guilty for hacking.

Tells you a lot about the attitude of many cooperations about these vulnerabilities.

Comment by mullingitover 10 hours ago

This one's still fresh in my mind: "A Missouri newspaper told the state about a security risk. Now it faces prosecution"[1]

[1] https://www.npr.org/2021/10/14/1046124278/missouri-newspaper...

Comment by theturtletalks 9 hours ago

Ah yes the government was putting teacher SSNs on the html client-side. Someone inspected element and found them and reported it. The governor went on a personal vendetta and tried to get him charged with CFAA violations which are no joke.

Made me realize we need way more coders in congress that understand basic technology. Especially with AI becoming a big part of society.

Comment by wat10000 7 hours ago

I don't think understanding is the issue. It doesn't take a lot of tech knowledge to understand "the SSNs were all being sent, they were just hidden poorly."

What we need is fewer vindictive, fragile people in positions of power. Unfortunately this is an unsolved problem.

Comment by solyin 6 hours ago

The problem with the people in power is that they were the ones seeking to be in power. If, instead, the mechanism was by lottery, thrusting the reigns of power upon any random citizen, the system wouldn't select for people who were also vindictive and fragile as a consequence of being egotistical enough to seek power.

Comment by sagarm 8 hours ago

This is not the answer to this problem. Instead vulnerability researchers should share their findings with potential victims so they can sue rather than reporting to Republican state governments that will simply sue them.

Comment by nradov 7 hours ago

What can the potential victims sue for specifically? Like what is the legal theory there? Which law has the state government broken and how would the plaintiffs get around sovereign immunity? Please to provide citations for the relevant statutes and case law.

Comment by AlexErrant 12 hours ago

I noticed I could see a family member's blood test results when clicking their forwarded email when I was logged into _my_ account. Sent an email. No response, but IIRC they fixed it a few weeks later.

Just an anecdote to counterbalance the apathy the OP might instill in people. Do good, regardless of the system.

Comment by AlexErrant 8 hours ago

I can't edit, so as a general response: ya'll are a cynical lot, akin to parents who won't let their child walk to school because of the 0.0001% chance they'll be kidnapped. Y'all making the whole world all the worse for your cynicism. Sure, there's a remote chance you get in trouble for it. But there's also a chance you get hit by a car tomorrow morning. Yet you got out bed anyway.

Be the fucking change. At the very least, don't discourage others. Good grief.

Comment by bobthebuilders 6 hours ago

I think that's a very privileged take. For most people, getting arrested and having the government try to press fraud and abuse charges is a life altering event, so it's natural that people would be more reticent.

Comment by AlexErrant 4 hours ago

If doing the right thing were easy, it wouldn't be what gives you character.

I agree: having charges brought against you is a life-changing event. FWIW neither Chan Tsz-yan nor Josh Renaud were arrested, and in both cases the charges were dropped. https://pressfreedomtracker.us/all-incidents/missouri-govern... https://missouriindependent.com/2022/02/11/prosecutor-isnt-p...

The system sucks, and will always suck.

If you think these two cases out of umpteen billion CVE/security incident reports are odds enough to hide your face and turn away because the risk is too much... I apologize for being crass, but frankly you're being a little bitch.

If these odds aren't good enough for you to live up to your values, what are?

Comment by thin_carapace 2 hours ago

you didn't have the guts to write me a response or to really acknowledge what the guy you're responding to here said. the things you say could be genuinely true , I'm not gonna absorb any of it since you're out here calling me a bitch while behaving like one yourself. was your goal to wave the finger or to inspire change in others? coz only one of those things happened today. by this point if you're an average human you'll have switched your brain off - on the off chance you're different, it's time to listen to the pot by tool

Comment by thin_carapace 11 hours ago

I think you have good intentions so I don't intend to attack you personally. just wanted to suggest that an individual being arrested for doing the right thing probably decreases the likelihood of them doing the right thing in future. so perhaps discretion is a good idea when doing the right thing, to increase chances of the right thing being done long term. there doesn't seem to exist a logical reason that corporations would avoid using the letter of the law to defend themselves, regardless as to how right that defense may be?

Comment by tough 10 hours ago

Deterrance not only works at the individual level, anyone reading these news reports about an innocent person being wrongly prosecuted for doing the right thing, is being trained to not do the right thing next time and just do nothing instead (because that's safer)

Comment by thin_carapace 10 hours ago

well I read those reports and came up with my comment above instead of running away so I'm not sure I can trust a conclusion based on your 'anyone' premise when the premise doesn't apply to me personally

Comment by tough 7 hours ago

anyone !== everyone

Comment by thin_carapace 7 hours ago

i assure u that nothing special has been accomplished by my body, most definitely i am an anybody and not a somebody. the purpose of a system is what it does, we dont have anything to disagree with outside of cheeky nit picks , so i guess this is good bye !

Comment by matltc 10 hours ago

Can confirm, not arrested but threatened with litigation/employer contacted for responsible disclosure of unsanitized user input allowing arbitrary access to protected data of presumably any user. Just a url query param value flipped from true to false. Incrementing int user id too, so enumeration is trivial and the response payload was json so no need to do anything.

It is amazing what a casual observer with a background in web dev will see if they just open devtools. It has instilled a deep aversion in me to give any service any of my data that I care about protecting.

Comment by tough 10 hours ago

There should be an anonymous org way to report these without putting yourself in personal jeopardy, some kind of "innocent observer" protections built in...

If your system has gaps im not at fault for discovering them sort of deal

Comment by socalgal2 9 hours ago

Unfortunately the anonymous org will then get abused by bad actors because of its anonymousness which leaves us where we are today

Comment by flir 9 hours ago

Long, long ago we had anonymous remailers.

It was a different time. Today, I don't think I'd trust an intermediary set up to - essentially - pass along 0-days not to sleep on the juicy ones.

Comment by tough 7 hours ago

wasn't that the origin of crypto and bitcoin too, or similar communities at least.

I think that's where I've read from about remailers in the past as in the same people who mined bitcoin early was into these

Comment by gosub100 9 hours ago

I dont see why we should do unpaid work for megacorps. If I found a vuln, I would seriously consider releasing it on the darknet if I could even figure out how to use it. Not even try to sell it, just give it to them. I have no sympathy for the shareholders, or the corporate drones that work there. Who actually feels the damage?

Comment by runsfromfire 8 hours ago

Unfortunately, the damage is usually felt by the individuals whose data is compromised.

Comment by gosub100 8 hours ago

they aren't being made whole by receiving "free credit monitoring" or a check for $12.83 18 months later either. maybe increasing the damages paid by the corporation is needed?

Comment by autoexec 12 hours ago

That says a lot more about the legal system than the airline

Comment by jdlshore 12 hours ago

Presumably the airline reported it.

Comment by noduerme 11 hours ago

But such a thing should not be prosecutable in the first place. Opening an unlocked door isn't breaking and entering. If you walk inside and steal something, that's a different thing. But if you just close the door and alert the owner that their door is unlocked, what sane person would consider that a crime?

Comment by SV_BubbleTime 11 hours ago

>But such a thing should not be prosecutable in the first place.

Bring it up with China. Hong Kong is in no serious way sovereign.

Comment by spacebanana7 8 hours ago

It’s easy to criticise large legacy orgs having bad security, but what should you actually do as a C suite leader to fix it in these orgs?

It’s easy to list the various code scanning and monitoring solutions, but what do you do if teams continue to fail to fix issues on time? And realistically there’s a shadow IT of shell scripts and macros you don’t have much visibility on.

You can’t fire everyone, so I think it’d be better to link compensation of engineers (especially leads/managers) to scan reports, incidents, and audits, even if these are imperfect. But even then you’ll have business complaints about taking away engineering capacity from feature delivery.

Comment by nradov 7 hours ago

The obvious first step is to outsource all IT infrastructure to one of the large service providers. While it's possible that they'll be breached, at least they have the resources and expertise to stand a fighting chance against the new wave of advanced persistent threats. Smaller companies outside the tech sector will never be able to keep up and secure their own systems. Like can you imagine some random manufacturing company hiring enough real security experts to keep up on their own? Even if they were willing to pay there around enough of those employees to go around. (I mean real security domain experts, not compliance process box checkers.)

It's unfortunate that every business now has to pay what effectively amounts to an IT security tax which will further enrich a small set of large tech companies. But that is our reality and there's no point in pretending otherwise.

Comment by stackskipton 15 hours ago

I'm not sure there will be corporate reckoning. Unless security breaches come with business impacting consequences, they will continue to ignore it and just pay out occasional class action lawsuit.

Comment by wtch98 14 hours ago

Jaguar-LandRover had a cyber attack which shut them down for months and nearly caused them to go bankrupt

https://en.wikipedia.org/wiki/Jaguar_Land_Rover_cyberattack

Of course they then blame "state sponsored" attackers.

https://www.techdigest.tv/2026/10/former-minister-confirms-j...

Comment by llama052 11 hours ago

These days they’ll add “sophisticated AI attack” and get a pass for shoddy security.

Comment by toomuchtodo 15 hours ago

I agree for data loss and ransomware where the ransom is paid, ie economically driven attacks. I wouldn’t agree when the hack is designed to kill the business destructively and no economic gain is sought or intended.

The difference in attack methodology is trivial, from a threat actor perspective, imho.

Comment by dboreham 15 hours ago

Sony Pictures is still in business.

Comment by toomuchtodo 15 hours ago

Zeabur is shutting down: what happens next - https://news.ycombinator.com/item?id=50198025 - October 2026

- On October 14, 2026 (UTC), an external attacker gained unauthorized access to Zeabur's internal systems and some customer services. We began our emergency response as soon as we detected the unusual activity. We have confirmed that this incident affected a broader scope than the incident in late August...Having another security incident in such a short time has let down the people who trusted us. Protecting your services and data is our responsibility, and we have fallen short.

The end of the road – OSGrid shutting down due to attack - https://news.ycombinator.com/item?id=50060854 - October 2026

7 Companies Forced to Shut Down After a Data Breach - https://n2ws.com/blog/5-companies-shut-down-data-breaches - March 4th, 2025

(if others have more examples, I am collecting them, please drop them in a reply)

Comment by ifwinterco 12 hours ago

Jaguar Land Rover didn't go bust (yet) but they had to shut down production in the UK for months following a cyber attack.

Very much a material impact on the bottom line and share price

Comment by judge2020 13 hours ago

I’ve been increasingly going with Delta regardless of price because of their tech being at least somewhat usable. I might even be inclined to switch to another carrier if they were to make entirely api-based (personal) access available for flight management and searching/booking (probably via MCP given the current climate, but I’ll take what I can get).

Comment by dehrmann 6 hours ago

Jevons has entered the room.

Comment by AnotherGoodName 14 hours ago

The "All modern digital infrastructure" xkcd (https://xkcd.com/2347/) where they had a fragile tower of blocks needs an update where those blocks are now collapsed on the floor in a complete mess.

Comment by jcranmer 14 hours ago

There's been some modifications to that image for the AI era. I don't know where the original source is to properly credit the creator, but one example is here: https://www.linkedin.com/posts/darshan-j-baligeri_all-modern...

Comment by vkou 13 hours ago

The corporate reckoning will only come if there's actual consequences for any of this. There haven't been any when this was happening to one big company a month, there won't be any when it starts happening to five big companies a day.

Comment by ricardobayes 14 hours ago

Perhaps it's time to... hire more engineers?

Comment by swatcoder 14 hours ago

Engineers aren't a help if they have poor inuition and insight into security concerns themselves, which is true for almost all of them.

Filling departments with inexperienced people based on how well they can recall a classic algorithm on a whiteboard was never the set up for a secure software or IT ecosystem. Peers watching in shock and dismay as supply chain risk escalated year over year for the last decade, among other horrifying practices, have been crying over this all along.

They might be able to follow an AI lead better than someone even less technical, but it's unclear that doing without true expertise as an oversight and check would cut it.

Having walked ourselves into it long before AI appeared, We're set up for a dark time with few easy outs.

Comment by btown 14 hours ago

I have a more nuanced take on this, which is that many engineers may have decent intuition on security - but that's entirely besides the point here, because without the political capital to have a large organization (and their customers and counterparties!) change their workflows and security stances, they're tilting at windmills. Security is not one of those things that one can throw bodies at - it requires true attention and commitment from leadership, and time to percolate across every facet of a company. If such a mandate is in place, talent is far from the limiting factor.

Comment by CSSer 11 hours ago

[dead]

Comment by iaaan 6 hours ago

As someone who has been working at a software supply chain security startup for the last 5 years of my life, watching it hemorrhage customers and watching our team get whittled down to essentially just me as our budget gets cut, while the rest of the company's token spend balloons past whatever we were paying the people we cut from my team... I think I'm done. I'm increasingly thinking I have to leave the computer industry in general or I'm going to off myself.

Comment by ChrisMarshallNY 8 hours ago

Hiring them is only the start.

Keeping them, and having them around, to be responsible for cleaning up their mess, is the trick.

Modern (US) tech companies are spectacularly bad at keeping talent.

Really, really bad.

Comment by Mountain_Skies 14 hours ago

I did AppSec for a couple of years just for a change of pace. The friend who worked there said they wanted to strengthen their infosec program in general, which is why they wanted to hire an SWE for AppSec instead of using cyber boot camp grads like they had been. Turned out 90% of infosec is about creating all of the necessary paperwork to protect to company from liability if there's a breach. Actual security issues were ignored most of the time if there wasn't a compliance framework that addressed the vuln directly. We could have tripled the number of people in the department and it wouldn't have made any difference in terms of actual security. Maybe the compliance paperwork would have been submitted a bit sooner.

Comment by SoftTalker 12 hours ago

The same engineers who built the vulnerable systems?

Comment by toomuchtodo 15 hours ago

https://pwn.watch

https://hn.algolia.com/?dateRange=all&page=0&prefix=false&qu...

https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que...

> it feels like we're actively witnessing a corporate reckoning around security posture the likes of which has never occurred.

As a cyber person, I agree. The theater has met reality, and those who put in the work will have an easier time than those who just checked a box. Good luck to all actively responding.

Comment by CSSer 14 hours ago

Safety alignment feels like an absolute farce and the completely wrong approach too. These things are guns, or attack dogs. We've never succeeded at reigning in software with this approach in the past, besides maybe DRM, which is itself laughable under many circumstances. This has the unprecedented ability to entertain the base desires of most juvenile threat actors, which is to get a big payout with minimal effort (let alone the pre-existing sophisticated attackers, who are now basically gods). Now we have a turn-key tool that can leverage and chain the most minute vulnerabilities up the ladder to full compromise or discover zero days with unyielding dedication. It feels like it almost makes CVE level classification moot.

Comment by toomuchtodo 14 hours ago

As someone who red teams with open weight models (GLM 5.3 currently) and a domain focused harness, I would agree with this. No regulation will prevent a sufficiently capable open model, nor stop the development of open models. Alignment efforts are “please don’t stop us from selling stock to the unsophisticated” imho. They aren’t stopping anyone competent and/or capable from model development and training.

Comment by CSSer 11 hours ago

As someone on the development side who just cares a lot about security, I've already witnessed the strict safety bite in the wrong direction too. IT staff are predictably terrified of the blast radius of these tools, so they're inclined to lock down internal enterprise agent subscription permissions so tightly that the tool is not only neutered but also incapable of doing pre-product release, staging testing or even responsible disclosure of vulnerabilities to adjacent teams at the speed at which threat actors will be able to move once it's in production. That's pretty bad. It's not like we don't wonder about the implications of architectural decisions we're making as we do them. We just often lack the bandwidth or resources to fully explore them. And there's a huge difference between "Let's see if I can DDoS this service" and "I wonder if that token is single use or not". If you're going to be tying your system to theirs, it seems like it's a good idea to question the latter and report that to them if it's not prior to shipping it. Forcing the engineer to do that manually helps no one good. I've always thought zero-trust was a little broken in this way, but now it feels really shattered.

Comment by dawnerd 14 hours ago

Norwegian cruise line had a similar thing recently with emails going out with actual booking information. Basically identical to the frontier scam emails. I wonder if there’s some customer service software that’s being exploited that they both use.

Edit: some info from the NcL one with screenshots that look similar https://www.reddit.com/r/NCL/comments/1x2q54e/warning_possib...

Comment by dbetteridge 13 hours ago

There was a post the other day that Amadeus (one of the major backend GDS systems) had been persistently exposing passenger information via a vulnerable endpoint since 2023

So that or similar other hacks

Comment by bronco21016 13 hours ago

Came here to point that out. Several airlines, mostly from Asia, have sent notice of data breaches related to Amadeus software. Frontier appears to contract with Amadeus.

https://amadeus.com/en/newsroom/press-releases/frontier-airl...

Comment by 999900000999 11 hours ago

This is why I love HN, looks like a solid root cause analysis.

Comment by touwer 10 hours ago

Can't see it. Reddit has become really open web hostile on mobile. Sad

Comment by pixl97 8 hours ago

I saw an article where they are going to login only outside of the US as a trial to go login only full time.

So yea, dead site.

Comment by jddkj 7 hours ago

What replaces Reddit? For the last years the only reliable way to get useful information on search was to add "Reddit" at the end.

Comment by bryan_w 7 hours ago

Digg

Comment by varenc 14 hours ago

My guess is something related to looking up Frontier flight status was abused to enumerate all active flight itineraries.

If Frontier had been completely breached and all data compromised, there's likely more lucrative things the attacker can do than just using the data to enhance their credit card stealing phishing attack.

Comment by tosti 13 hours ago

For anyone else who has never heard of it: Frontier Airlines is a budget airline company based in Colorado USA.

Comment by JumpCrisscross 12 hours ago

I have a couple friends who fly them, mostly on account of their all-you-can-fly $250 pass [1].

[1] https://www.flyfrontier.com/deals/gowild-pass/?mobile=true

Comment by atomicfiredoll 1 hour ago

Lot's of people don't like them. But, I flew Frontier a decent bit when I just wanted to go "get away" and had flexibility to do so. It was fine enough, because my expectations were appropriately set and I travel light.

But, their website has always given me tons of problems. My ability to successfully purchase a ticket often felt totally random.

Comment by rationalist 5 hours ago

TIL… thank you!!!

Comment by paulddraper 12 hours ago

It’s the 8th most popular airline in North America, behind Air Canada and Jet Blue.

Comment by 999900000999 16 hours ago

Various users are reporting scam emails with full booking details.

Stay safe guys.

Comment by phren0logy 15 hours ago

Every interaction I've ever had with Frontier Airlines has been negative.

Comment by nharada 12 hours ago

I've never met human employees with less latitude to actually help me

"oh yeah that's wrong, sorry it looks like our website is broken but there's nothing I can do"

Comment by saturn8601 29 minutes ago

Those people are contract workers. Spirit had the same issue: Excellent plane operations (No crashes in their history, history of excellence in maintenance, pretty well paid and well benefited employees(supposedly),modern planes). With their low cost model, the money had to come from somewhere: contracted front staff that don't care/can't do anything and fees for everything including the water.

Comment by swasheck 11 hours ago

The stories about their lack of customer service empowerment following the man who was ingested by an engine while running across the runway validate this. It was truly maddening to read about how the company handled getting people’s luggage back to them.

Comment by jukkan 14 hours ago

Earlier this year, Frontier was one of the orgs that got their data leaked thanks to incorrectly configured security settings on their Microsoft Power Pages based website. While this is unlikely to be the source for current flight confirmation numbers, such data could sure help in phishing operations.

https://venarix.com/blog/exfilsquad-targets-misconfigured-mi...

Comment by RetroTechie 11 hours ago

Only 2 breaches/critical remote CVEs on HN frontpage today? Must be a slow news day lol!

Comment by CreepyHunterX 15 hours ago

If someone got that email - check the email headers and the 'Authentication-Results' field to verify SPF/DKIM/DMARC alignment. If a domain has a DMARC policy of 'p=none', a forged "From" field will not be rejected-it will land in the inbox and look completely genuine.

Comment by danieltk76 15 hours ago

thankfully I already had frontier airlines marked as spam email, so this changes nothing for me.