Details of 45m Batik Air customers leaked in 2019 reportedly resurface online

The personal details of Batik Air passengers which were leaked in 2019 have reportedly resurfaced online. Batik Air offically rebranded from Malindo Air earlier this year. A database dump made available on 3 September was published online and contained email addresses, dates of birth, physical addresses, passport numbers, and phone numbers claimed to be breached in 2019. The forum user also claimed to possess these details.

According to The Star, not all 45 million entries are legitimate as they contain a mix of duplicated entries and dummy data. A+M has reached out to Batik Air for comment.

In September 2019, Batik Air, then operating as Malindo Air, confirmed that the data breach had been contained. It explained that two former employees of its eCommerce services provider, GoQuo in their development centre in India had improperly accessed and stole customers' personal data. The airline also reported the matter to Malaysian and Indian police.

It added that it was working closely with all the relevant agencies including the Malaysian Personal Data Protection Commissioners and the National Cyber Security Agency as well as their overseas counterpart. Meanwhile, it stressed that this incident is not related to the security of its data architecture or that of its cloud provider Amazon Web Services. The airline also engaged data forensics and cyber security experts to review its existing data infrastructure and processes. The airline also later pleaded not guilty in its court charges for the data breach incident in 2020. 

Related articles:
Lion Group rebrands Malindo Air to establish common identity
Malindo Air alerts consumers of fake website, plans to file police report
Malindo Air reportedly asks staff to take pay cut amidst COVID-19 outbreak
Malindo Air pleads not guilty for data breach charges
Malindo Air data breach triggered by former employees of eCommerce firm
Malindo Air investigates customer data breach