Vietnam Airlines Data Breach

Testing some emails in haveibeenpwned i realized something terrible about these leaks.

In isolation, ok, you have just your personal data like birthdate, name, phone number leaked just based on an email.

But now that there was so many leaks, just taking a single email, you can easily map an important part of the profile of a person. Give me an email, I now have: - All identification details, sometimes scanned id documents - linkedin details about the professional details of a person, which company when, ... - Even without the clear official address, you can have an average estimation of where the person live by looking at the countries or location of breached companies. - I can see with leak of big and small retailers like CostCo where the person is doing is shopping. Sometimes it can be worse for specialized retailers, like knowing that you might be vegetarian, or like buying electronic products. - With telecom providers breachs, you know the internet and mobile provider of a person, you can also discover that the person has multiple phone and mobile lines. - With leaks of forum and so, you can see if a user is into specific topics. - With things like leaks of airline providers like that, you can know if the person is a frequent flyers, might be a frequent visitor of some countries or area of the world as companies are often highly linked with their HQ country base. - You might also know that a person is frequently living in another place/country than its official residence ...

Using email alias for per account helps avoid tying your details across websites works pretty well as long as phone number is not associated with said account.

Also helps in tracking misbehaving websites that sells/leaks your emails or subject your email with excessive spam. I recall Stack Social is one of the worst offenders.

Qantas got caught up too.

For those that don't know, Qantas stands for Queensland and Northern Territory Airline Service.

Makes me feel OK about my strategy to use a different email for every sign up

I don't think Salesforce itself was hacked. It says "data stolen from the Salesforce instances of multiple companies".

HIBP links to [1], which links to [2], which says

>The FBI last week warned airlines in the US that the group was targeting the aviation sector. In a post on X, the FBI said the group uses social engineering techniques, often impersonating employees or contractors to deceive IT help desks into granting access, and bypassing multi-factor authentication.

So it sounds like phishing attacks against the individual airlines. It sounds pretty much the same as [3], which goes into detail of the exact mechanism that phishers can use to steal Salesforce data. It does sound like it is a little bit Salesforce's fault, because Salesforce's UI makes it really easy to grant an attacker access to your database without realizing it. Salesforce needs to improve the permission granting UI so that it's clearer what is going on.

[1] https://www.theguardian.com/business/2025/oct/11/hackers-lea...

[2] https://www.theguardian.com/business/2025/jul/02/qantas-conf...

[3] https://cloud.google.com/blog/topics/threat-intelligence/voi...