American Airlines subsidiary Envoy caught in Clop's Oracle EBS raid

Envoy Air, an American Airlines subsidiary, has confirmed that it was among the dozens of organizations compromised via Oracle E-Business Suite (EBS) security flaws, following claims by Clop extortionists that its parent company was one of its victims. "We are aware of the incident involving Envoy's Oracle E-Business Suite …

[VoiceOfTruth]

It's time for more disclosure

>> the intruders likely had a three-month head start on the defenders

I feel reasonably sure that American Airlines and Envoy take computer security pretty seriously. They likely have intrusion detection systems, anti-virus with 'heuristics' as appropriate, traffic analysis, auditing, and so on. If those systems cannot detect this sort of thing then it's time to name and shame them, because they are clearly not up to the job. It hardly matters if it is a zero day exploit if it is not noticed for three months.

This isn't being nasty towards AA. It seems from reports that 'dozens' of organisations were hit. So that probably means none of the systems works reliably against a crim who knows what he is doing. We see it with F5 - a security company isn't secure.

[Anonymous Coward]

Re: It's time for more disclosure

Reminds me of an old old fire safety slogan ...

'When is a Door Not a Door ... When it's ajar !!!'

:)

[Apocalypso - a cheery end to the world]

Typical low-cost airline

I'm guessing they sell all their passenger data anyway so this is just a mis-configuration of the "partner portal".

Icon: the non-flying icon