Ryanair “hacked”, millions stolen, phishing suspected


The Independent has reported, that Ryanair “has been targeted in an international scam that siphoned millions of euro from its bank accounts”, more specifically, around €4.5 million.

The Independent further states “it is believed that thieves managed to initiate a single fraudulent transaction using a Chinese bank when stealing the money from the airline”, that it is working intensely with banks to retrieve the stolen money and that “as this matter is subject to legal proceedings, no further comment will be made.”

This isn’t the first major cyber-issue to have hit Ireland though. There was the known case of Paddy Power and a massive data leak that resulted in the exposure of personal data of 649,000 people, including names, addresses and birth dates. ESET Ireland has recently detected an increase in malicious activity online, targeting email addresses in the country with scammming and phishing campaigns using the names of Bank of Ireland, DHL and Irish Revenue. And in the previous years, there were other resounding cases. Bord Gais laptop loss with info of 75,000 customers, Phoenix Ireland loss of personal details of about 62,000 customers, Bank of Ireland’s missing USB key with about 900 customer account numbers, names and addresses, Ireland Department of Social and Family Affairs stolen laptop with personal information of 380,000, Enda Farrell, a former manager with Nama leaked property portfolios worth billions of Euro for private purposes to his wife and a laptop containing the details of a number of children attending HSE Speech and Language Therapy services in Donegal was reported stolen from the boot of the car of a HSE staff member.

Brian Honan, CEO of BH Consulting and Special Advisor on Internet Security to Europol’s European Cybercrime Centre (EC3), commented the Ryanair affair for Help Net Security “There are very few details available publicly as to how this scam was conducted. If, as outlined in some reports, the scam was the result of a hack it would seem most likely the methods used by the criminals would have been to phish credentials from key staff members with access to the relevant banking systems. Criminals are now developing their attacks to target people instead of the computers they use, so our defences can no longer rely solely on technical controls, but rather we need the right processes are in place to protect key systems and that staff have proper and effective security awareness training. We should also look to our financial institutions to implement more effective fraud prevention and detection mechanisms to better protect customer accounts.”

Ireland, so it seems, is not just a popular tourist destination anymore, but also a prime target for international cybercriminals. Irish companies and organisations would be wise to give cybersecurity strategies some additional attention, to prevent similar things from happening.

by Urban Schrott, ESET Ireland

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s