“It’s crucial that all organisations take into account their relationship with third parties when creating cyber security strategies and ensure that every endpoint in the cyber security chain is secure. It only takes one vulnerable device or server to compromise an entire network, and in turn, impact business reputation and the security of thousands of customers.” The incident follows a string of high profile cyber attacks in which people's details have been stolen by hackers. Yesterday Three Mobile has said that 76,373 more customers were affected in a major data breach first revealed by the Telegraph last year. The figure brings the total number of people whose information was compromised by cyber criminals to 210,200, up 57 per cent on the company's initial estimates. And Yahoo has recently admitted that it was hit with the world's largest ever cyber attack involving a breach of customer data. The historic hack, which occurred in 2013, could have resulted in the company losing the personal details and passwords of one billion accounts, it admitted. "We recently became aware of unauthorised access to the web server supporting abta.com by an external infiltrator exploiting a vulnerability. The web server is managed for ABTA through a third party web developer and hosting company. The infiltrator exploited that vulnerability to access data provided by some customers of ABTA Members and by ABTA Members themselves via the website. "On further, urgent investigation we identified that the incident occurred on the 27th February 2017 and related to some customer information, including complaints about ABTA Members, and to documentation uploaded via abta.com in support of ABTA membership. Although encrypted, passwords used by ABTA Members and customers of ABTA Members to access our website may also have been accessed.
A recent cyber attack on travel trade organisation Abta’s website may have put the personal identity information of about 43,000 holidaymakers in jeopardy. Abta has confirmed about 1,000 files that may include personal identity information could have been compromised in the 27 February attack. Bank details were not stolen, but other information could be used for fraudulent purposes such as opening false bank accounts. The data appears not to have been shared by the attacker and Abta is continuing to monitor the situation. Security firm Avecto has said that the attack was preventable, saying it was a third party that had fallen short.