Leaked Vendor Credentials Exposed Operations Portal Serving 200 Airports
Summary
CloudSEK says leaked credentials for a subcontractor exposed a vendor portal serving more than 200 airports. The portal lacked MFA and provided operational visibility and diagnostic tools; the credentials were revoked and MFA was rolled out.
Key points
- An engineer at a subcontracted aviation maintenance firm had credentials leaked on an underground forum.
- The credentials could access a vendor’s NGOSS operations portal serving more than 200 airports; the portal lacked multi-factor authentication.
- The portal exposed infrastructure inventories, internal network details, live passenger-system status, and server performance data.
- It also offered network diagnostic tools that could potentially be misused for internal denial-of-service attacks.
- The article says no breach occurred; it describes potential disruption scenarios rather than confirmed attacks or losses.
- The credentials were revoked, emergency MFA rollout began, and third-party accounts were audited. The article recommends tighter, limited-duration vendor access and credential reviews.
Article Details
- Event Type
- Exposure of leaked credentials for a fourth-party airport maintenance firm's account, which could access an aviation IT vendor's NGOSS portal serving more than 200 airports. The article reports potential unauthorized access, not a completed breach.
- Impact
- The exposed credentials could have enabled access to airport infrastructure inventories, live passenger-system status, backend performance data, and network diagnostic functions. The article describes possible kiosk, baggage, and multi-hub outages, with estimated losses ranging from approximately $3.5 million to over $1 billion depending on the scenario. It says the credentials were revoked, emergency MFA was rolled out, and third-party accounts were audited.