Inspiring Vacations has wound up an “in-depth forensic investigation” into a leak of sensitive customer information.
The travel company said a probe into the November 2023 incident revealed that files containing details of passports, driving licences, visas, COVID certificates and other information had been hacked from an “isolated part of the organisation’s systems”.
Upon identification, the impacted folder was secured, containing the incident. There has been no further unauthorised access to files since then.
Following the competition of the investigation, Inspiring Vacations notified customers who were potentially affected by the breach.
The company said impacted individuals were also provided with steps that can be taken to mitigate any future risks.
“We were determined to conduct a full and comprehensive investigation into these claims, so that we could provide the best advice and guidance to those who were impacted,” Inspiring Vacations Managing Director Paul Ryan said in a statement emailed to Karryon.
“We are deeply sorry that this has happened and apologise for any concern or distress that our initial communications in December might have caused.
“We were determined to contact all potentially impacted people at the earliest opportunity, before investigations allowed us to engage directly with the group who face a risk of data misuse.”
Who was impacted?
Setting the record straight, Inspiring Vacations confirmed that the number of people at risk from the data breach was “significantly smaller” than earlier media reports suggested.
This week, the Sydney Morning Herald reported that thousands of travellers had been involved in the incident, in which a database containing some 112,000 records was leaked online.
Exposed records included an estimated 24,000 itinerary and e-ticket PDF documents, some of which comprised partial credit card numbers.
According to SMH, the cybersecurity researcher who discovered the breach, Jeremiah Fowler, said the leaked information “if discovered by hackers can pose numerous possible risks to the affected individuals”.
“Hypothetically, passport data could be used for identity theft, allowing criminals to open accounts, apply for credit cards, or conduct fraudulent activity in the victims’ names,” he stated.
“Identity documents can also potentially be used for numerous illegal activities. One possible example would be if a cybercriminal is engaged in an extortion scheme – with a victim who is unrelated to the data breach – and needs a way to accept the blackmailed funds.
“In this scenario, the criminal could simply open an account with a legitimate crypto exchange or financial app using the name and personal details from one of the exposed passports.”
Fowler said that the exposed database also contained a folder of CVs including full names, addresses, phone numbers and email addresses.
The majority of the affected travellers are Australians, with some New Zealanders, Britons, and Irish customers, he added.
It is unclear if hackers got hold of any information or how long it was exposed.
“Finding out what happened and determining how to prevent reoccurrence has been of paramount importance since we were first made aware of the claims,” Ryan added.
“The completion of our investigation and the ability to provide the necessary precautionary steps for those people impacted is the result of painstaking work by many people within our organisation.”
As is required when a cybersecurity incident has occurred, an update on the investigation has been provided to the Office of the Australian Information Commissioner and other related agencies.
The Inspiring Vacations incident is the latest of many cyber-attacks to hit a major Australian company, the most high profile of which was a recent data breach at communications giant Optus.
Labelling itself the most awarded tour operator in Australia, Inspiring Vacations offers hundreds of escorted and independent tours and cruises globally. It has stores around the world, including in Australia, the United States and India.
