Sabre Confirms Employee Data Exposed In Ransomware Attack; Information Appears On Dark Web
Travel technology giant Sabre has acknowledged a significant data breach resulting from a ransomware attack more than a year ago. The incident led to the exposure of sensitive personal information of approximately 30,000 employees, with some of the data appearing on the dark web.
Sabre, headquartered in the United States, provides travel and booking services to over 400 airlines and tens of thousands of travel agencies worldwide. The company confirmed in breach notification letters sent recently that the attack, believed to align with the Dunghill Leak ransomware group’s activities, compromised extensive employee data.
On September 6, 2023, Sabre became aware that an “unauthorized party” had accessed employee data. That same day, reports emerged of the Dunghill Leak group claiming responsibility for stealing 1.3 terabytes of data from the company. The attackers reportedly posted some of the stolen information on the dark web in a series of leaks that concluded in October 2023.
Sabre’s internal investigations, supported by third-party forensic experts, revealed that the exposed data included full names, Social Security numbers, dates of birth, employment-related information, financial account details, identification documents such as passports, driver’s licenses, or national IDs and personal signatures.
This breach did not involve customer data, according to Sabre. However, the scale of the attack raises concerns about the potential misuse of employee data for identity theft, scams, or phishing schemes.
To mitigate the impact on affected individuals, Sabre is providing 24 months of complimentary identity protection services. The company has not publicly disclosed the ransom demands or whether any payment was made.
The breach marks a troubling recurrence of cybersecurity incidents for Sabre. In 2017, the company suffered another breach in which payment card information for hotel reservations was compromised.
