Personal details of 284 KrisFlyer members disclosed due to software bug: SIA

SINGAPORE - Personal details of over 280 KrisFlyer members may have been seen by other customers due to a software bug affecting Singapore Airlines' (SIA) website on Friday (Jan 4).

"We have been made aware of a number of cases in which a customer logged in to his or her KrisFlyer account, under certain specific conditions, may have been able to see selective details of another customer," an SIA spokesman said in response to queries.

These details may have included names, e-mail addresses, account numbers, membership tier statuses, KrisFlyer miles and rewards, travel history and in seven cases, passport details.

The spokesman added that the breach occurred when any two members log in to their KrisFlyer accounts and access transactions displaying their membership information at the same time, while also being assigned the same server by the system.

In a statement, SIA said that no changes were made to members' accounts and no credit card details were disclosed.

Investigations based on system logs determined 284 cases in total, it added.

"We have established that this was a one-off software bug and was not the result of an external party's breach of our systems or members' accounts," SIA said.

"The issue has been resolved and we will carry out a detailed review to ensure this will not happen again."

The software bug arose from a change to SIA's website homepage on Friday, and the incident occurred between about 2am and 12.15pm.

SIA said that it is following up directly with affected customers, and has voluntarily informed the Personal Data Protection Commission.

"The protection of our customers' personal data is of utmost importance to SIA, and we sincerely regret the incident," it added.

This article was first published in The Straits Times. Permission required for reproduction.