TSA ‘no fly’ list leaked after being found on unsecured airline server

A international hacker obtained an previous copy of the U.S. authorities’s Terrorist Screening Database and “no fly” list from an unsecured server belonging to a business airline. 

The Swiss hacker referred to as “maia arson crimew” blogged Thursday that she found the Transportation Security Administration “no fly” list from 2019 and a trove of information belonging to CommuteAir on an unsecured Amazon Web Services cloud server utilized by the airline. 

The hacker informed The Daily Dot the list appeared to have greater than 1.5 million entries. The information reportedly included names and birthdates of assorted people who’ve been barred from air journey by the federal government as a consequence of suspected or known ties to terrorist organizations. The Daily Dot reported that the list incorporates a number of aliases, so the variety of distinctive people on the list is way much less at 1.5 million.

Noteworthy people reported to be on the list embody Russian arms dealer Viktor Bout, who was not too long ago freed by the Biden administration in trade for WNBA star Brittney Griner, and suspected members of the IRA and others, in line with The Daily Dot. 

FAA REVEALS WHAT CAUSED COMPUTER OUTAGE PROMPTING GROUND STOP

ID requirement indicators on the entrance to the passenger TSA safety space in West Palm Beach, Fla.  (Lindsey Nicholson/UCG/Universal Images Group by way of Getty Images / Getty Images)

US EXTENDS AIR TRAVEL COVID-19 VACCINE MANDATE FOR INTERNATIONAL VISITORS

“It’s simply loopy to me how massive that terrorism screening database is, and but there may be nonetheless very clear tendencies in the direction of virtually solely Arabic and Russian sounding names all through the million entries,” crimew informed the outlet. 

Reached for remark, a TSA spokesman mentioned the company is “conscious of a possible cybersecurity incident, and we’re investigating in coordination with our federal companions.” 

In an announcement to FOX Business, CommuteAir confirmed the legitimacy of the hacked “no fly” list and information that contained non-public details about the corporate’s staff. 

A Transportation Security Administration pre-check signal stands at Dulles International Airport in Dulles, Va., Aug. 19, 2015. ( Andrew Harrer/Bloomberg by way of Getty Images / Getty Images)

FTX SAYS HACKERS STOLE $415M AFTER CRYPTOCURRENCY EXCHANGE FILED FOR BANKRUPTCY

“CommuteAir was notified by a member of the safety analysis neighborhood who recognized a misconfigured improvement server,” mentioned Erik Kane, company communications supervisor for CommuteAir. “The researcher accessed recordsdata, together with an outdated 2019 model of the federal no-fly list that included first and final title and date of delivery. Additionally, via info found on the server, the researcher found entry to a database containing private identifiable info of CommuteAir staff.

“Based on our preliminary investigation, no buyer information was uncovered,” Kane added. “CommuteAir instantly took the affected server offline and began an investigation to find out the extent of information entry. CommuteAir has reported the information publicity to the Cybersecurity and Infrastructure Security Agency and in addition notified its staff.”

An Embraer ERJ-145XR plane operated by CommuteAir. (CommuteAir / Fox News)

CommuteAir is a regional airline based in 1989 and primarily based in Ohio. The firm operates with hubs in Denver, Houston and Washington Dulles and operates greater than 1,600 weekly flights to over 75 U.S. locations and three in Mexico.

CLICK HERE TO READ MORE ON FOX BUSINESS

According to crimew’s Wikipedia web page, which the hacker maintains is correct, she was indicted by a grand jury within the United States in March 2021 on prison costs associated to her alleged hacking exercise between 2019 and 2021. Her Twitter bio describes her as “indicted hacktivist/safety researcher, artist, mentally sick enby polyam trans lesbian anarchist kitten (θΔ), 23 years previous.”