What happened
In March 2021 Air New Zealand notified some Airpoints members that the systems of a Star Alliance partner had been breached [rnz-airnz]. The affected system was reportedly SITA’s passenger processing system, which SITA said was attacked on 24 February 2021 [airnz-1news]. Air NZ said the data involved was limited to names, tier status and Airpoints membership numbers — not passwords, card details, itineraries, passport numbers or contact details — and told customers they did not need to change their passwords [airnz-1news]. The number of members affected was not precisely disclosed and is not estimated here.
Timeline
- 2021-02-24 — Attack on the third-party passenger processing system, as reported [airnz-1news].
- 2021-03-05 — Air NZ notified affected Airpoints members and apologised [rnz-airnz], [airnz-1news].
Current status
Disclosed. No regulator involvement has been found in the sources. Figures are as reported. [rnz-airnz], [airnz-1news]
Why it matters
A supply-chain case: loyalty data held by an airline’s alliance partners and industry IT providers can be exposed even when the airline’s own systems are not breached.