Air Creebec hit by administrative data breach affecting employees and passengers

Air Creebec, a regional Quebec airline owned by the Cree Nation of Eeyou Istchee, reported a data breach Wednesday affecting both customers and staff. In a press release, the company announced “an unauthorized intrusion targeting some of its administrative systems.” The release stresses that the breach did not compromise any systems associated with aircraft, flight operations or flight safety, noting the company’s administrative systems were not connected with aircraft and flight systems, which it said operate independently. “Initial findings indicate that administrative files were exfiltrated,” states the release. “These files may contain personal information relating mainly to current and former employees, as well as passengers. Others may also contain operational, administrative or financial information related to customers and partners. The review is ongoing.” Based in the airport of Val d’Or in the Abitibi-Témiscamingue region of western Quebec, roughly 520 kilometres northwest of Ottawa, Air Creebec offers flights to 16 destinations in Quebec and Ontario. The company’s fleet consists of 21 Dash-8 turboprop regional airliners, along with one ATR 72 turboprop air-freighter for cargo, and carries 200,000 passengers per year. Cybersecurity experts assessing damage Air Creebec director for Marketing and Business Development Edward Trahan said the breach was identified in October after which company officials immediately brought in cybersecurity experts to analyze the situation. “They’re currently evaluating what’s going on and what the breach actually contained,” Trahant told APTN News. “The experts are still conducting their review, so there’s no numbers [of victims] at this time that we can give.” He added that for security reasons, he was not presently willing to name the cybersecurity team currently helping with post-breach recovery. He said because the attack was designed to go undetected it was hard to determine the date upon which it began, and for how long attackers were able to access Air Creebec’s systems prior to being discovered. “What I can assure you of is that as soon as [we were] made aware of [it], we acted immediately and did not wait.” At the moment, Trahant said the attack appeared to have stolen information “related to our employees, past employees too, and maybe even our passengers.” “But it’s hard to confirm at the moment.” Company will contact affected parties He added that a priority for Air Creebec is contacting every one of their staff or customers whose information has been compromised, which cybersecurity experts would undertake to carry out as soon as possible. “A part of what the cybersecurity experts are doing for us is gathering information to [determine] what kind of protection packages we can provide to people that had their information involved,” said Trahan. “Those people will be directly contacted in probably the next few days — [but] probably more like [the next] day — about what package they will receive, what protection they’re going to have and how long it’s going to last.” Trahan said the cybersecurity team was currently in the process of securing all possible intrusion points, but he said the nature of cybersecurity is that 100 per cent protection is impossible. “It’s just the way of the world,” he said, “but they are closing every possible way to get in and they are getting to the very end of that. As for how they got in initially, we don’t know yet and I don’t want to speculate while the review is still underway.” Trahan said he and Air Creebec are taking the situation very seriously and are committed to supporting all those affected, and the company said it would be in touch with affected people to offer “appropriate protective measures,” including the possibility of credit-monitoring and identity-protection services. “Those services will be based on the nature of the information exposed and the risks that were identified,” he said. “So individuals that are eligible to receive this protection will be informed directly and will be given a list of steps to follow in the very near future.” Jesse StaniforthOnline Journalist | MontrealJesse joined APTN as a producer after 16 years as a print and web journalist. During seven of those years, he covered the Cree Nation of Eeyou Istchee for community newsmagazine The Nation. Jesse’s writing on Indigenous issues has also appeared in Canadian Geographic, the Toronto Star, the Rover, The Eastern Door, Metro, and the Huffington Post. Continue Reading