Massive E-Learning Data Breach in Spain Exposes 6 Million Users
A Spanish e-learning platform was hit by a massive breach exposing data on over 6 million users, now up for sale on a hacker forum.
Incidents
Vacation Canceled? Massive VoyageSecure Data Breach Puts Millions of Travelers' Data Up for Sale
Data on millions of VoyageSecure customers, including travel histories and contact details, is for sale on the dark web after a cloud misconfiguration.
A Bitter End to the Holidays: Millions of Travelers' Data Up for Sale
Popular hotel and flight booking platform VoyageSecure has just confirmed that it was hit by a massive data breach. Information on more than 15 million customers around the world is already available on a well-known dark web forum. If you have ever used the service, this news should set off alarm bells.
What Was Leaked and How Did It Happen?
According to preliminary findings, the attackers gained access to one of the company's databases hosted in a public cloud. The cause was mundane and, unfortunately, still common: misconfigured access permissions that left the digital front door wide open.
The criminals got their hands on a substantial set of data:
- Customers' full names.
- Email addresses and phone numbers.
- Booking histories, including travel dates and destinations.
- Hashed passwords for platform accounts.
- Partial payment card data (the last 4 digits).
The company stresses that full payment card numbers were not compromised. Even so, the stolen information is a ready-made database for sophisticated phishing attacks. Because criminals know your travel plans, they can send highly convincing fake messages about "problems with your booking" designed to trick you into handing over your full details.
What Now? Steps to Protect Yourself
VoyageSecure has started a mass password reset and has promised free credit monitoring for affected customers in markets where it is available. Regardless, we recommend that you:
- Change your VoyageSecure password immediately. If you used the same password anywhere else, change it there too!
- Turn on two-factor authentication (2FA) wherever possible.
- Be extremely cautious with emails and text messages that claim to come from VoyageSecure. Don't click any links and don't share any information.
This incident is yet another painful reminder that our data is a valuable currency in today's world, and the companies we entrust it to don't always protect it with due care.
A similar breach recently hit a Spanish e-learning platform, where data on 6 million users was stolen. Implementing ISO 27001 helps companies manage information security systematically and prevent incidents like these.
Sources: VoyageSecure statement, The Cyber Record
