Air NZ data breach

A phishing scam has affected two staff accounts at Air New Zealand, resulting in a breach of customer data.

The attack has affected the accounts of around 3.5 per cent of Air New Zealand Airpoints customers, an Air New Zealand spokeswoman said.

Personal information from customer membership profiles was accessed.

Air New Zealand said customers’ Airpoints accounts and credit card details had not been affected by the scam. However, personal information relating to customers’ membership profiles may have been visible to hackers in Air New Zealand’s internal documents.

The two affected staff accounts had been secured and Air New Zealand said it was conducting a thorough investigation into how the breach occurred.

‘‘We’re focused on further hardening our security processes to help prevent any similar incidents from happening again in the future,’’ an email sighted by Stuff to one affected customer stated.

An Air New Zealand spokeswoman said in an email that it had received confirmation of the breach yesterday and informed customers.

She said the airline’s IT team ‘‘immediately secured the two affected staff accounts’’ and it was strengthening its security processes to prevent similar incidents.

‘‘Unfortunately, malicious attacks of this nature are becoming more common.’’

Air NZ ‘‘apologised to our customers for any inconvenience’’.

Air New Zealand was encouraging customers to be on alert for a phishing email over the next few months.

Spokesman for the Office of the Privacy Commissioner, Charles Mabbett, said it had been notified of the data breach on July 31.

He was unable to provide further details about what had occurred.

‘‘We have just been told about it and we trust that they are following data breach best practice in containing this breach.

‘‘If someone feels they have been harmed by this data breach they can always make a complaint to our office,’’ he said.