MALINDO Airways Sdn Bhd has assured passengers that it does not store any customer payment details on its servers as it investigates a massive data breach that has caused the leak of passengers’ personal data.

“We have put in adequate measures to ensure that the data of our passengers is not compromised in line with the Malaysian Personal Data Protection Act.

“We also do not store any payment details of our customers in our servers and are compliant with the payment card industry (PCI) data security standard (DSS),” the subsidiary of Indonesian budget carrier Lion Air said in a statement today.

It also advised passengers who have Malindo Miles accounts to change their passwords.

It was reported earlier that the personal data of millions of passengers have been leaked in a massive data breach affecting Lion Air, Malindo Air and possibly Batik Air, also another Lion Air subsidiary.

The data includes passport details, home addresses and phone numbers.

Malindo Airways said its in-house teams along with external data service providers, Amazon Web Services and GoQuo, are currently investigating the breach.

“We are in the midst of notifying the various authorities both locally and abroad including CyberSecurity Malaysia… and also engaging with independent cybercrime consultants to investigate and report into this incident.”

Tech website Bleeping Computer, which reported on the data breach, said the records of passengers “have been circulating on data exchange forums for at least a month”.

The personal data is stored in an Amazon bucket that is open on the web, in a directory holding back-up files, which appear to have been created in May this year. – September 18, 2019.