It seems early to speculate, but if this is related to the massive uptick in CVEs we've been seeing recently it feels like we're actively witnessing a corporate reckoning around security posture the likes of which has never occurred.
Someone found a vulnerability in the system of Hong Kong Airlines that let the user to see the details of another passenger by changing a few characters in the URL. He reported the issue to the airlines. Then he was prosecuted and found guilty for hacking.
Tells you a lot about the attitude of many cooperations about these vulnerabilities.
I noticed I could see a family member's blood test results when clicking their forwarded email when I was logged into _my_ account. Sent an email. No response, but IIRC they fixed it a few weeks later.
Just an anecdote to counterbalance the apathy the OP might instill in people. Do good, regardless of the system.
I think you have good intentions so I don't intend to attack you personally. just wanted to suggest that an individual being arrested for doing the right thing probably decreases the likelihood of them doing the right thing in future. so perhaps discretion is a good idea when doing the right thing, to increase chances of the right thing being done long term. there doesn't seem to exist a logical reason that corporations would avoid using the letter of the law to defend themselves, regardless as to how right that defense may be?
Deterrance not only works at the individual level, anyone reading these news reports about an innocent person being wrongly prosecuted for doing the right thing, is being trained to not do the right thing next time and just do nothing instead (because that's safer)
well I read those reports and came up with my comment above instead of running away so I'm not sure I can trust a conclusion based on your 'anyone' premise when the premise doesn't apply to me personally
Can confirm, not arrested but threatened with litigation/employer contacted for responsible disclosure of unsanitized user input allowing arbitrary access to protected data of presumably any user. Just a url query param value flipped from true to false. Incrementing int user id too, so enumeration is trivial and the response payload was json so no need to do anything.
It is amazing what a casual observer with a background in web dev will see if they just open devtools. It has instilled a deep aversion in me to give any service any of my data that I care about protecting.
There should be an anonymous org way to report these without putting yourself in personal jeopardy, some kind of "innocent observer" protections built in...
If your system has gaps im not at fault for discovering them sort of deal
But such a thing should not be prosecutable in the first place. Opening an unlocked door isn't breaking and entering. If you walk inside and steal something, that's a different thing. But if you just close the door and alert the owner that their door is unlocked, what sane person would consider that a crime?
I'm not sure there will be corporate reckoning. Unless security breaches come with business impacting consequences, they will continue to ignore it and just pay out occasional class action lawsuit.
I agree for data loss and ransomware where the ransom is paid, ie economically driven attacks. I wouldn’t agree when the hack is designed to kill the business destructively and no economic gain is sought or intended.
The difference in attack methodology is trivial, from a threat actor perspective, imho.
- On October 14, 2026 (UTC), an external attacker gained unauthorized access to Zeabur's internal systems and some customer services. We began our emergency response as soon as we detected the unusual activity. We have confirmed that this incident affected a broader scope than the incident in late August...Having another security incident in such a short time has let down the people who trusted us. Protecting your services and data is our responsibility, and we have fallen short.
I’ve been increasingly going with Delta regardless of price because of their tech being at least somewhat usable. I might even be inclined to switch to another carrier if they were to make entirely api-based (personal) access available for flight management and searching/booking (probably via MCP given the current climate, but I’ll take what I can get).
Engineers aren't a help if they have poor inuition and insight into security concerns themselves, which is true for almost all of them.
Filling departments with inexperienced people based on how well they can recall a classic algorithm on a whiteboard was never the set up for a secure software or IT ecosystem. Peers watching in shock and dismay as supply chain risk escalated year over year for the last decade, among other horrifying practices, have been crying over this all along.
They might be able to follow an AI lead better than someone even less technical, but it's unclear that doing without true expertise as an oversight and check would cut it.
Having walked ourselves into it long before AI appeared, We're set up for a dark time with few easy outs.
I have a more nuanced take on this, which is that many engineers may have decent intuition on security - but that's entirely besides the point here, because without the political capital to have a large organization (and their customers and counterparties!) change their workflows and security stances, they're tilting at windmills. Security is not one of those things that one can throw bodies at - it requires true attention and commitment from leadership, and time to percolate across every facet of a company. If such a mandate is in place, talent is far from the limiting factor.
I did AppSec for a couple of years just for a change of pace. The friend who worked there said they wanted to strengthen their infosec program in general, which is why they wanted to hire an SWE for AppSec instead of using cyber boot camp grads like they had been. Turned out 90% of infosec is about creating all of the necessary paperwork to protect to company from liability if there's a breach. Actual security issues were ignored most of the time if there wasn't a compliance framework that addressed the vuln directly. We could have tripled the number of people in the department and it wouldn't have made any difference in terms of actual security. Maybe the compliance paperwork would have been submitted a bit sooner.
The corporate reckoning will only come if there's actual consequences for any of this. There haven't been any when this was happening to one big company a month, there won't be any when it starts happening to five big companies a day.
The "All modern digital infrastructure" xkcd (https://xkcd.com/2347/) where they had a fragile tower of blocks needs an update where those blocks are now collapsed on the floor in a complete mess.
> it feels like we're actively witnessing a corporate reckoning around security posture the likes of which has never occurred.
As a cyber person, I agree. The theater has met reality, and those who put in the work will have an easier time than those who just checked a box. Good luck to all actively responding.
Safety alignment feels like an absolute farce and the completely wrong approach too. These things are guns, or attack dogs. We've never succeeded at reigning in software with this approach in the past, besides maybe DRM, which is itself laughable under many circumstances. This has the unprecedented ability to entertain the base desires of most juvenile threat actors, which is to get a big payout with minimal effort (let alone the pre-existing sophisticated attackers, who are now basically gods). Now we have a turn-key tool that can leverage and chain the most minute vulnerabilities up the ladder to full compromise or discover zero days with unyielding dedication. It feels like it almost makes CVE level classification moot.
As someone who red teams with open weight models (GLM 5.3 currently) and a domain focused harness, I would agree with this. No regulation will prevent a sufficiently capable open model, nor stop the development of open models. Alignment efforts are “please don’t stop us from selling stock to the unsophisticated” imho. They aren’t stopping anyone competent and/or capable from model development and training.
As someone on the development side who just cares a lot about security, I've already witnessed the strict safety bite in the wrong direction too. IT staff are predictably terrified of the blast radius of these tools, so they're inclined to lock down internal enterprise agent subscription permissions so tightly that the tool is not only neutered but also incapable of doing pre-product release, staging testing or even responsible disclosure of vulnerabilities to adjacent teams at the speed at which threat actors will be able to move once it's in production. That's pretty bad. It's not like we don't wonder about the implications of architectural decisions we're making as we do them. We just often lack the bandwidth or resources to fully explore them. And there's a huge difference between "Let's see if I can DDoS this service" and "I wonder if that token is single use or not". If you're going to be tying your system to theirs, it seems like it's a good idea to question the latter and report that to them if it's not prior to shipping it. Forcing the engineer to do that manually helps no one good. I've always thought zero-trust was a little broken in this way, but now it feels really shattered.
Norwegian cruise line had a similar thing recently with emails going out with actual booking information. Basically identical to the frontier scam emails. I wonder if there’s some customer service software that’s being exploited that they both use.
There was a post the other day that Amadeus (one of the major backend GDS systems) had been persistently exposing passenger information via a vulnerable endpoint since 2023
Came here to point that out. Several airlines, mostly from Asia, have sent notice of data breaches related to Amadeus software. Frontier appears to contract with Amadeus.
My guess is something related to looking up Frontier flight status was abused to enumerate all active flight itineraries.
If Frontier had been completely breached and all data compromised, there's likely more lucrative things the attacker can do than just using the data to enhance their credit card stealing phishing attack.
Earlier this year, Frontier was one of the orgs that got their data leaked thanks to incorrectly configured security settings on their Microsoft Power Pages based website. While this is unlikely to be the source for current flight confirmation numbers, such data could sure help in phishing operations.
The stories about their lack of customer service empowerment following the man who was ingested by an engine while running across the runway validate this. It was truly maddening to read about how the company handled getting people’s luggage back to them.
If someone got that email - check the email headers and the 'Authentication-Results' field to verify SPF/DKIM/DMARC alignment. If a domain has a DMARC policy of 'p=none', a forged "From" field will not be rejected-it will land in the inbox and look completely genuine.
Can't see it. Reddit has become really open web hostile on mobile. Sad
It seems early to speculate, but if this is related to the massive uptick in CVEs we've been seeing recently it feels like we're actively witnessing a corporate reckoning around security posture the likes of which has never occurred.
Someone found a vulnerability in the system of Hong Kong Airlines that let the user to see the details of another passenger by changing a few characters in the URL. He reported the issue to the airlines. Then he was prosecuted and found guilty for hacking.
Tells you a lot about the attitude of many cooperations about these vulnerabilities.
This one's still fresh in my mind: "A Missouri newspaper told the state about a security risk. Now it faces prosecution"[1]
[1] https://www.npr.org/2021/10/14/1046124278/missouri-newspaper...
I noticed I could see a family member's blood test results when clicking their forwarded email when I was logged into _my_ account. Sent an email. No response, but IIRC they fixed it a few weeks later.
Just an anecdote to counterbalance the apathy the OP might instill in people. Do good, regardless of the system.
I think you have good intentions so I don't intend to attack you personally. just wanted to suggest that an individual being arrested for doing the right thing probably decreases the likelihood of them doing the right thing in future. so perhaps discretion is a good idea when doing the right thing, to increase chances of the right thing being done long term. there doesn't seem to exist a logical reason that corporations would avoid using the letter of the law to defend themselves, regardless as to how right that defense may be?
Deterrance not only works at the individual level, anyone reading these news reports about an innocent person being wrongly prosecuted for doing the right thing, is being trained to not do the right thing next time and just do nothing instead (because that's safer)
well I read those reports and came up with my comment above instead of running away so I'm not sure I can trust a conclusion based on your 'anyone' premise when the premise doesn't apply to me personally
Can confirm, not arrested but threatened with litigation/employer contacted for responsible disclosure of unsanitized user input allowing arbitrary access to protected data of presumably any user. Just a url query param value flipped from true to false. Incrementing int user id too, so enumeration is trivial and the response payload was json so no need to do anything.
It is amazing what a casual observer with a background in web dev will see if they just open devtools. It has instilled a deep aversion in me to give any service any of my data that I care about protecting.
There should be an anonymous org way to report these without putting yourself in personal jeopardy, some kind of "innocent observer" protections built in...
If your system has gaps im not at fault for discovering them sort of deal
That says a lot more about the legal system than the airline
Presumably the airline reported it.
But such a thing should not be prosecutable in the first place. Opening an unlocked door isn't breaking and entering. If you walk inside and steal something, that's a different thing. But if you just close the door and alert the owner that their door is unlocked, what sane person would consider that a crime?
>But such a thing should not be prosecutable in the first place.
Bring it up with China. Hong Kong is in no serious way sovereign.
I'm not sure there will be corporate reckoning. Unless security breaches come with business impacting consequences, they will continue to ignore it and just pay out occasional class action lawsuit.
Jaguar-LandRover had a cyber attack which shut them down for months and nearly caused them to go bankrupt
https://en.wikipedia.org/wiki/Jaguar_Land_Rover_cyberattack
Of course they then blame "state sponsored" attackers.
https://www.techdigest.tv/2026/10/former-minister-confirms-j...
These days they’ll add “sophisticated AI attack” and get a pass for shoddy security.
I agree for data loss and ransomware where the ransom is paid, ie economically driven attacks. I wouldn’t agree when the hack is designed to kill the business destructively and no economic gain is sought or intended.
The difference in attack methodology is trivial, from a threat actor perspective, imho.
Sony Pictures is still in business.
Zeabur is shutting down: what happens next - https://news.ycombinator.com/item?id=50198025 - October 2026
- On October 14, 2026 (UTC), an external attacker gained unauthorized access to Zeabur's internal systems and some customer services. We began our emergency response as soon as we detected the unusual activity. We have confirmed that this incident affected a broader scope than the incident in late August...Having another security incident in such a short time has let down the people who trusted us. Protecting your services and data is our responsibility, and we have fallen short.
The end of the road – OSGrid shutting down due to attack - https://news.ycombinator.com/item?id=50060854 - October 2026
7 Companies Forced to Shut Down After a Data Breach - https://n2ws.com/blog/5-companies-shut-down-data-breaches - March 4th, 2025
(if others have more examples, I am collecting them, please drop them in a reply)
Jaguar Land Rover didn't go bust (yet) but they had to shut down production in the UK for months following a cyber attack.
Very much a material impact on the bottom line and share price
I’ve been increasingly going with Delta regardless of price because of their tech being at least somewhat usable. I might even be inclined to switch to another carrier if they were to make entirely api-based (personal) access available for flight management and searching/booking (probably via MCP given the current climate, but I’ll take what I can get).
Perhaps it's time to... hire more engineers?
Engineers aren't a help if they have poor inuition and insight into security concerns themselves, which is true for almost all of them.
Filling departments with inexperienced people based on how well they can recall a classic algorithm on a whiteboard was never the set up for a secure software or IT ecosystem. Peers watching in shock and dismay as supply chain risk escalated year over year for the last decade, among other horrifying practices, have been crying over this all along.
They might be able to follow an AI lead better than someone even less technical, but it's unclear that doing without true expertise as an oversight and check would cut it.
Having walked ourselves into it long before AI appeared, We're set up for a dark time with few easy outs.
I have a more nuanced take on this, which is that many engineers may have decent intuition on security - but that's entirely besides the point here, because without the political capital to have a large organization (and their customers and counterparties!) change their workflows and security stances, they're tilting at windmills. Security is not one of those things that one can throw bodies at - it requires true attention and commitment from leadership, and time to percolate across every facet of a company. If such a mandate is in place, talent is far from the limiting factor.
The same engineers who built the vulnerable systems?
I did AppSec for a couple of years just for a change of pace. The friend who worked there said they wanted to strengthen their infosec program in general, which is why they wanted to hire an SWE for AppSec instead of using cyber boot camp grads like they had been. Turned out 90% of infosec is about creating all of the necessary paperwork to protect to company from liability if there's a breach. Actual security issues were ignored most of the time if there wasn't a compliance framework that addressed the vuln directly. We could have tripled the number of people in the department and it wouldn't have made any difference in terms of actual security. Maybe the compliance paperwork would have been submitted a bit sooner.
The corporate reckoning will only come if there's actual consequences for any of this. There haven't been any when this was happening to one big company a month, there won't be any when it starts happening to five big companies a day.
The "All modern digital infrastructure" xkcd (https://xkcd.com/2347/) where they had a fragile tower of blocks needs an update where those blocks are now collapsed on the floor in a complete mess.
There's been some modifications to that image for the AI era. I don't know where the original source is to properly credit the creator, but one example is here: https://www.linkedin.com/posts/darshan-j-baligeri_all-modern...
https://pwn.watch
https://hn.algolia.com/?dateRange=all&page=0&prefix=false&qu...
https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que...
> it feels like we're actively witnessing a corporate reckoning around security posture the likes of which has never occurred.
As a cyber person, I agree. The theater has met reality, and those who put in the work will have an easier time than those who just checked a box. Good luck to all actively responding.
Safety alignment feels like an absolute farce and the completely wrong approach too. These things are guns, or attack dogs. We've never succeeded at reigning in software with this approach in the past, besides maybe DRM, which is itself laughable under many circumstances. This has the unprecedented ability to entertain the base desires of most juvenile threat actors, which is to get a big payout with minimal effort (let alone the pre-existing sophisticated attackers, who are now basically gods). Now we have a turn-key tool that can leverage and chain the most minute vulnerabilities up the ladder to full compromise or discover zero days with unyielding dedication. It feels like it almost makes CVE level classification moot.
As someone who red teams with open weight models (GLM 5.3 currently) and a domain focused harness, I would agree with this. No regulation will prevent a sufficiently capable open model, nor stop the development of open models. Alignment efforts are “please don’t stop us from selling stock to the unsophisticated” imho. They aren’t stopping anyone competent and/or capable from model development and training.
As someone on the development side who just cares a lot about security, I've already witnessed the strict safety bite in the wrong direction too. IT staff are predictably terrified of the blast radius of these tools, so they're inclined to lock down internal enterprise agent subscription permissions so tightly that the tool is not only neutered but also incapable of doing pre-product release, staging testing or even responsible disclosure of vulnerabilities to adjacent teams at the speed at which threat actors will be able to move once it's in production. That's pretty bad. It's not like we don't wonder about the implications of architectural decisions we're making as we do them. We just often lack the bandwidth or resources to fully explore them. And there's a huge difference between "Let's see if I can DDoS this service" and "I wonder if that token is single use or not". If you're going to be tying your system to theirs, it seems like it's a good idea to question the latter and report that to them if it's not prior to shipping it. Forcing the engineer to do that manually helps no one good. I've always thought zero-trust was a little broken in this way, but now it feels really shattered.
Norwegian cruise line had a similar thing recently with emails going out with actual booking information. Basically identical to the frontier scam emails. I wonder if there’s some customer service software that’s being exploited that they both use.
Edit: some info from the NcL one with screenshots that look similar https://www.reddit.com/r/NCL/comments/1x2q54e/warning_possib...
There was a post the other day that Amadeus (one of the major backend GDS systems) had been persistently exposing passenger information via a vulnerable endpoint since 2023
So that or similar other hacks
Came here to point that out. Several airlines, mostly from Asia, have sent notice of data breaches related to Amadeus software. Frontier appears to contract with Amadeus.
https://amadeus.com/en/newsroom/press-releases/frontier-airl...
This is why I love HN, looks like a solid root cause analysis.
My guess is something related to looking up Frontier flight status was abused to enumerate all active flight itineraries.
If Frontier had been completely breached and all data compromised, there's likely more lucrative things the attacker can do than just using the data to enhance their credit card stealing phishing attack.
Various users are reporting scam emails with full booking details.
Stay safe guys.
Earlier this year, Frontier was one of the orgs that got their data leaked thanks to incorrectly configured security settings on their Microsoft Power Pages based website. While this is unlikely to be the source for current flight confirmation numbers, such data could sure help in phishing operations.
https://venarix.com/blog/exfilsquad-targets-misconfigured-mi...
For anyone else who has never heard of it: Frontier Airlines is a budget airline company based in Colorado USA.
I have a couple friends who fly them, mostly on account of their all-you-can-fly $250 pass [1].
[1] https://www.flyfrontier.com/deals/gowild-pass/?mobile=true
It’s the 8th most popular airline in North America, behind Air Canada and Jet Blue.
Every interaction I've ever had with Frontier Airlines has been negative.
I've never met human employees with less latitude to actually help me
"oh yeah that's wrong, sorry it looks like our website is broken but there's nothing I can do"
The stories about their lack of customer service empowerment following the man who was ingested by an engine while running across the runway validate this. It was truly maddening to read about how the company handled getting people’s luggage back to them.
Only 2 breaches/critical remote CVEs on HN frontpage today? Must be a slow news day lol!
If someone got that email - check the email headers and the 'Authentication-Results' field to verify SPF/DKIM/DMARC alignment. If a domain has a DMARC policy of 'p=none', a forged "From" field will not be rejected-it will land in the inbox and look completely genuine.
thankfully I already had frontier airlines marked as spam email, so this changes nothing for me.