For quite some time, flying private has been synonymous with privacy, exclusivity, and convenience. However, next to this luxury is often an underreported vulnerability: the security of an individual’s personal information. Private aviation companies can collect too much sensitive data such as Social Security Numbers and payment information to manage charters, memberships, and regulatory compliance. When the bad guys get access to that information, the fallout can be devastating!
A recent case in point is Priester Holdings, LLC, a private aviation company located in Illinois - and its growing risk is now more evident. The company reported a data breach when unauthorized persons accessed its network and obtained customer information including names and Social Security numbers. This incident raises the important question: how safe is your personal data when flying private?
The Neglected Aspect of Personal Travel
Commercial airline companies have well-defined data protection systems due to strict regulations. Private aviation companies, however, operate using smaller teams, and the budgets for cybersecurity are often much smaller, and they collect personal information that is equal to or even more sensitive.
Booking a charter flight generally requires:
- Government issued identification
- Social Security Number or Passport Number
- Contact and financial information
- Personalized travel preferences for VIP services
This combination of personal information and financial data makes the private aviation sector a prime target for cybercriminals. Cybercriminals view these organizations as having weaker defences as compared to major airlines or government agencies, yet they have data that has the same value.
Why Aviation Data Is So Important
Cybercriminals understand that private aviation customers are usually part of wealthy clientele, like business leaders, celebrities, and political officials. Stolen data about these individuals can lead to identity theft, fraud, and possibly extortion.
More than just the risk of fraud, exposed flight information and flight itineraries can compromise personal safety and compromise company confidentiality. For example, if a company executive's travel itinerary is publicly known, it is possible it will compromise sensitive business decisions or negotiations.
The Legal and Ethical Side of Data Protection
Organizations collecting personal data in the United States have a legal obligation to keep this information private and protected pursuant to laws like the Health Insurance Portability and Accountability Act (HIPAA) and various state level data privacy laws. While laws governing data privacy and data protection are fairly clear with the healthcare industries and banking and financial institutions, the aviation sector oftentimes finds itself in a gray area of compliance, especially smaller private operators.
Those potentially harmed by incidents like the Priester Holdings data breach might have plans for class action data breach claims against the easyJet data breaching incident, if they suffered harm as a result of identity theft or financial loss. Individuals who have suffered harm by a data breach can hire a data breach attorney in the U.S. who can discuss their rights, seek reimbursement, and generally provide representation in order to protect sensitive data privacy. It is thoughtful for consumer lawyers generally to provide a letter notifying consumers like a data breach event for all parties involved. Consumer lawyers will usually indicate when a breach occurs and the impacted party should be notified clearly. Keeping everything documented is an ideal situation to build trust inadvertently.
Cybersecurity Obstacles in Private Aviation Solutions
The aviation industry is dealing with a distinct assortment of cybersecurity obstacles:
- Legacy systems that were not intended for digital security.
- Third-party vendors (e.g., booking platforms or maintenance systems) that do not adhere to the same baseline security standards.
- Employees participating in remote work and engaging in the use of personal devices, thereby increasing the level of exposure points.
- Less overall compliance awareness than larger carriers.
Many private operators have third-party IT vendors providing services without conducting security background checks. This gap exposes opportunities for attackers to use weak access to gain systems or to get access and exploit weaknesses in legacy software.
Ways for Businesses to Secure Passenger Data
To protect and secure data, companies in the aviation industry should:
- Analyze and perform regular cybersecurity audits and penetration tests.
- Possibly encrypt sensitive information belonging to passengers and employees.
- Adopt a multi-factor authentication (MFA) practice for access to internal systems.
- Train employees to detect and identify phishing and social engineering tactics.
- Possibly create a complete incident response plan to engage at any time an incident occurs.
The bottom line is that cybersecurity should be seen as a priority, not an afterthought.
What Travelers Can Do
There is also a role for travelers to play in data protection:
- Use discretion with the amount of information shared unless necessary.
- Use a secure and unique password for any aviation service portal you access.
- Continually monitor credit reports and bank accounts for unknown or suspicious activity.
- Before booking a reservation, ask the company how they store and protect your data.
Your awareness and approach can help significantly reduce the risks.
The Bottom Line
Flying private is a unique experience in the air, but it does not mean you can experience that same exclusivity when it comes to network behavior. Regardless of industry status, the Priester Holdings LLC Data Breach should remind you that you are not out of reach of a cyber attack. You are not only concerned with your data privacy in aviation anymore—but now privacy is also a matter of trust, accountability, and ethics.
As travelers, information and vigilance are likely the best methods to ensure your privacy is respected beyond the cabin doors.
