Actor claims sale of SITA data and infrastructure access
A threat actor on an underground forum claims to sell data and infrastructure access tied to SITA, the IT and communications provider behind much of global air transport. The post lists 950,000+ email attachments with network and IT details, 650,000+ conversations with partner airlines, and employee data. The claim remains unverified.
What happened
A threat actor on an underground forum claims to sell data and infrastructure access tied to SITA, the IT and communications provider behind much of the global air transport industry. The offer lists 950,000+ email attachments with network and IT details and 650,000+ conversations with partner airlines. The claim has not been independently verified and SITA has not commented in the sources.
Why it matters
If genuine, the sale exposes airline-vendor correspondence and employee data for SITA and Hawaiian Airlines, with Qatar Airways, Alaska Airlines, British Airways, American Airlines and EgyptAir named as partners. DailyDarkWeb assesses the material would be a strong base for targeted phishing, vendor impersonation and follow-on intrusions across the aviation supply chain.
What to do
Treat as an unverified claim and watch for SITA-themed lures. Tighten identity checks in vendor communications and review access and integrations tied to SITA.
For the technical team
- Affected
- SITA, provedora de TI e comunicações do transporte aéreo global; alegação de venda de dados de e-mails (anexos com detal · SITA (IT and communications for air transport). Data cited: SITA and Hawaiian Airlines; named partners: Qatar Airways, Alaska Airlines, British Airways, American Airlines and EgyptAir.
- Exploitation
- Underground forum claim of data and access sale, reported by DailyDarkWeb; not independently verified. No victim confirmation, PoC or KEV.
- Fix
- Not applicable (alleged leak). The seller claims some endpoints remain unpatched.
- Vector
- Initial vector not described in the sources; the post claims sale of infrastructure access and says some endpoints remain unpatched.
- More details
- The forum post lists 950,000+ email attachments with network and IT details, 650,000+ conversations between SITA and partner airlines, and employee data. The seller claims unpatched endpoints and that "fresh" data can still be pulled. DailyDarkWeb flags it as an unverified threat-actor claim and states there is no confirmation of a breach.
Timeline
First public claim of sale of SITA-linked data and access.
Sources 1 source
- @DailyDarkWeb @DailyDarkWeb
