The Straits Times
This photograph taken on March 28, 2018 shows a Singapore Airlines (SIA) Airbus A350 aircraft taking off from Singapore Changi Airport. (AFP/Roslan Rahman)
Personal details of over 280 KrisFlyer members may have been seen by other customers due to a software bug affecting Singapore Airlines’ (SIA) website on Friday (Jan 4).
“We have been made aware of a number of cases in which a customer logged in to his or her KrisFlyer account, under certain specific conditions, may have been able to see selective details of another customer,” an SIA spokesman said in response to queries.
These details may have included names, e-mail addresses, account numbers, membership tier statuses, KrisFlyer miles and rewards, travel history and in seven cases, passport details.
The spokesman added that the breach occurred when any two members log in to their KrisFlyer accounts and access transactions displaying their membership information at the same time, while also being assigned the same server by the system.
On Saturday, Facebook user Tricia Leo said in a post that when she logged into her KrisFlyer account, she realised that she could see another person’s e-mail address on her profile page.
“I tried a new login and I could see his entire history, upcoming trips, miles,” she wrote.
“If organisations that demand our personal data don’t guard our information properly, then they need to be called out on it.”
In a statement, SIA said that no changes were made to members’ accounts and no credit card details were disclosed.
Investigations based on system logs determined 284 cases in total, it added.
“We have established that this was a one-off software bug and was not the result of an external party’s breach of our systems or members’ accounts,” SIA said.
"The issue has been resolved and we will carry out a detailed review to ensure this will not happen again."
The software bug arose from a change to SIA’s website homepage on Friday, and the incident occurred between about 2am and 12.15pm.
SIA said that it is following up directly with affected customers, and has voluntarily informed the Personal Data Protection Commission (PDPC).
A PDPC spokesman confirmed that it had been notified of the incident, and added that the commission was looking into it.
“The protection of our customers’ personal data is of utmost importance to SIA, and we sincerely regret the incident,” SIA added.