French Flight Booking Website 'Option Way' Leaks 100GB Worth Of Customer Data

Based in France, Option Way which was customer base from around the world, helps users find flight deals to and from various destinations.

And here, according to a report by security research firm vpnMentor, the website was leaking 100Gb worth of unsecured customer data to the public internet.

The leak which was discovered by vpnMentor's internet privacy researchers Noam Rotem and Ran Locar, explained that:

"The data breach exposed the personal details of customers, creating a complete profile, as well as detailed information about their flights and travel arrangements. In total, our team had access to over 100GB of data, compromising the privacy and security of Option Way and its users. "
Option Way database leak
An example of the Option Way's unsecured data, showing a customer’s email address. (Credit: vpnMentor

Option Way claims that its website is protected by an SSL certificate. This should encrypt any data transaction made to the site, as they are processed in line with the recommendations set out by the CNIL (France’s data protection authority).

However, the researchers discovered that the statement isn't true.

"Our team was able to access over 100 GB of data, a massive amount of customers’ unencrypted Personally Identifiable Information (PII)," the post continued.

Examples of personal details we viewed included: Customer names, Date of Birth, Gender, Email addresses, Phone numbers, Home Address & postcode. Dates of flight departure and return, Destinations, and Flight Prices.

The report noted that the leaked customer data were mainly from France, Belgium, Switzerland, Algeria, and Australia.

Apart from customers’ data, the database also contained details of the company’s employees and credit cards used for transactions.

[block:block=87]

Unsecured database exposes sensitive data to the internet, is "a goldmine for identity thieves and other attackers," said the researchers.

By putting together all the data found in the Option Way database leak, people with malicious intentions could use the information for illegal activities, that include:

  • Phishing and fraud.
  • Ticket account takeover.
  • Robbery.
  • Credit card fraud.
  • Compromising Option Way' business model.
  • Reputational damage to Option Way.

The list can go on.

vpnMentor found this leak when its researchers scan ports looking for familiar IP blocks and use these blocks to find holes in a company’s web system. Once these holes are found, the team looks for vulnerabilities that would lead them to a data breach.

The researchers at vpnMentor discovered this unsecured database on August 20th, and informed Option Way a few days later.