Attack on Sabre reportedly conducted by Anthem, OPA hackers

American Airlines is investigating its own systems, but says there's no evidence of a breach so far

American Airlines travel self-check in kiosk

Self check-in kiosks are shown at the American Airlines terminal at Los Angeles International Airport. American is investigating its computer systems for signs of a breach. 

Credit: Mario Anzuoni/Reuters

Travel industry software maker Sabre is the latest company said to have been hit by the same hackers who recently attacked U.S. health insurer Anthem and the U.S. Office of Personnel Management (OPM), while American Airlines has been investigating its own systems for evidence of a similar breach.

Texas-based Sabre, whose technology processes reservations for hundreds of airlines and thousands of hotel properties, on Friday confirmed that its systems were compromised.

"We recently learned of a cybersecurity incident, and we are conducting an investigation into it now," Sabre said. "At this time, we are not aware that this incident has compromised sensitive protected information, such as credit card data or personally identifiable information, but our investigation is ongoing."

A Bloomberg news service report, citing "three people with knowledge of the cybersecurity probes," suggested that both Sabre and American Airlines were the victims of attacks by the China-backed hackers who hit Anthem and the OPM.

American, however, said it has found no sign of a breach.

"Our cybersecurity is always evolving -- it's a constant battle every day," said Casey Norton, an American Airlines spokesman. "When one of our partners has communicated a breach, we redouble our efforts and bring in more cybersecurity experts to investigate our systems."

So far there's been no evidence of a compromise and no evidence of any loss of customer data, Norton said.

IP addresses used by the OPM hackers reportedly matched activity found in American Airlines' computer logs, but that may not signify a breach at the airline.

Sabre became an independent company as a spinoff from American Airlines back in 2000. Because of the two companies' close historical ties, some of the IP addresses now used by Sabre are still registered to American, Norton noted. As a result, reports of an attack on an IP address owned by American doesn't necessarily mean the airline itself was hacked, he added.

The two companies began their investigations in the last month, according to Bloomberg.

Just last week, United Airlines was found to be another victim of the same wave of attacks.

Sabre processes 2 billion transactions every day, it says, affecting a billion travelers every year.

To express your thoughts on Computerworld content, visit Computerworld's Facebook page, LinkedIn page and Twitter stream.
Windows 10 annoyances and solutions
Shop Tech Products at Amazon
Notice to our Readers
We're now using social media to take your comments and feedback. Learn more about this here.