American Airlines Traces Breach to Phishing Incident

Airline Phishing IncidentAmerican Airlines has disclosed that an attacker used phishing attacks to breach the company’s systems, BleepingComputer reports.

“On July 5, 2022, American identified unauthorized activity in its Microsoft 365 environment after individuals reported receiving phishing emails from an American employee's account,” the company said in a legal filing. “Further investigation by American's Cyber Security Response Team (‘CIRT) revealed certain accounts may have been accessed by an unauthorized actor who used the accounts to send phishing emails. The unauthorized actor may have also previewed certain files on an employee sharepoint site.”

The threat actor continued to send phishing emails to other employees from each compromised account.

“Through its investigation, American was able to determine that the unauthorized actor used an IMAP protocol to access the mailboxes,” the statement says. “Use of this protocol may have enabled the unauthorized actor to sync the contents of the mailboxes to another device. American has no reason to believe that syncing the contents of the mailboxes was the purpose of the access. Based on the fact, it appears the unauthorized actor was using IMAP protocol as a means to access the mailboxes and send phishing emails.”

The attacker gained access to personal information, but American thinks it would be too time-consuming for the attacker to harvest much of the data.

“Notwithstanding, following the forensic investigation, American conducted an extensive eDiscovery exercise to determine whether any personal information was contained in the mailboxes,” the company says. “The review identified personal information in the mailboxes on or around August 16, 2022. The information in the mailboxes may have included name, Social Security number, employee number, date of birth, mailing address, phone number, email address, driver’s license number, and/or passport number.”

New-school security awareness training can teach your employees to recognize phishing and other social engineering attacks.

BleepingComputer has the story.

Free Phishing Security Test

Would your users fall for convincing phishing attacks? Take the first step now and find out before bad actors do. Plus, see how you stack up against your peers with phishing Industry Benchmarks. The Phish-prone percentage is usually higher than you expect and is great ammo to get budget.

PST ResultsHere's how it works:

  • Immediately start your test for up to 100 users (no need to talk to anyone)
  • Select from 20+ languages and customize the phishing test template based on your environment
  • Choose the landing page your users see after they click
  • Show users which red flags they missed, or a 404 page
  • Get a PDF emailed to you in 24 hours with your Phish-prone % and charts to share with management
  • See how your organization compares to others in your industry

Go Phishing Now!

PS: Don't like to click on redirected buttons? Cut & Paste this link in your browser:

Topics: Phishing

Subscribe To Our Blog

Ransomware Hostage Rescue Manual

Get the latest about social engineering

Subscribe to CyberheistNews