Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Vietnam Airlines Data Breach

haveibeenpwned.com

Post reply on HN
Print view View original

31–39 of 39 posts

Re: Vietnam Airlines Data Breach

#31

Post by basilikum »

zkmon wrote: post #3

Trying to understand what's the real damage here. Dates of birth, Email addresses, Loyalty program details, Names, Phone numbers - how is one going to use this data to cause a loss the data owner? If any security check depends on this data by considering it as a secret, then I guess it's the fault of that security check.

Phishing, scams and social engineering mostly. Such breaches are a gold mine for that.

Scam calls are a lot more credible when rather than starting with "Hello, this is Microsoft calling. There is a problem with your computer." you get a call like:

"Hello Mr. zkmon, this is Mallory from MasterCard. I'm calling to verify a recent, suspicious transaction from your card to Vietnam Airlines on August 6th. We just want to make sure that was you and your card is not being misused. Before we do that can we please quickly verify your identity? I see here in our system that you're born in 1996. Can you please tell me your exact birth date so I can be sure I'm really talking to Mr. zkmon?"

Bonus points when the breach contains what bank you are at so they can pretend to be them.

Also such databreaches are useful for stalking people or tracking people down with very little information and then doxing them etc. Say all you have is an online username of someone you don't like, so you just search a database of leaks for that string. From there you get an email address and full name. And from there you can continue searching other breaches with those details and using other public sources.

Re: Vietnam Airlines Data Breach

#32

Post by thenthenthen »

ryandrake wrote: post #29
skeeter2020 wrote: post #24

Earlier quoted context omitted.

if you run your own domain and have a wildcard for email this is a very good strategy. I also never provide my real birthdate for (almost) anything. The vast majority DO NOT NEED IT, and the rare case where it might be required (still doubt it, but maybe age of majority or consent, or a waiver) I use Jan 1st of the real year. This has caused problems (ex: doesn't match your id) but on the balance seems to be positive…

Even without your own email hosting, Gmail kind of lets you do this by appending +whatever to your address before @gmail.com. Obviously this can be trivially detected and stripped but I suppose it is better than nothing. Multiple real Email addresses are definitely a best practice.

Like: myname+whatever@gmail.com?

Re: Vietnam Airlines Data Breach

#33

Post by rkomorn »

thenthenthen wrote: post #32
ryandrake wrote: post #29

Earlier quoted context omitted.

Even without your own email hosting, Gmail kind of lets you do this by appending +whatever to your address before @gmail.com. Obviously this can be trivially detected and stripped but I suppose it is better than nothing. Multiple real Email addresses are definitely a best practice.

Like: myname+whatever@gmail.com?

Yep. I do this a lot. It occasionally doesn't work (eg: some sites don't think + is valid).

To be fair, I don't think it's made a huge difference in my life. In fact it's possibly been more of a negative than a positive.

Re: Vietnam Airlines Data Breach

#34

Post by skybrian »

zenmac wrote: post #12
flotzam wrote: post #10

Earlier quoted context omitted.

It's inherently a loss of privacy that anyone (given that the dataset is now public) can correlate > Dates of birth, Email addresses, Loyalty program details, Names, Phone numbers

>In October 2025, data stolen from the Salesforce.... Seems like a salesforce leak. Not to single out sales force here. Could easily be fill in the ____ big corp. When are people going to get there is no absolute digital security. And at currently state, it is much more secure to NOT have all the data aggregated in one place. Of course this would go against the data mining operation. We should look at this from a per…

There are lots of Saleforce customers getting hacked. [1]

> Insurance giant Allianz Life, Google, fashion conglomerate Kering, the airline Qantas, carmaking giant Stellantis, credit bureau TransUnion, and the employee management platform Workday, among several others, have confirmed their data was stolen in these mass hacks.

Perhaps it's bad security defaults which are in some sense user error, but when it becomes common pattern then I think the company needs to make systematic fixes.

Compare with many Snowflake customers getting hacked.

[1] https://techcrunch.com/2025/10/03/hacking-group-claims-theft...

Re: Vietnam Airlines Data Breach

#35

Post by kijin »

zkmon wrote: post #21
zkmon wrote: post #8

Earlier quoted context omitted.

As I mentioned, the real issue is around considering of this data as a secret.

Just to clarify to the downvoters: I meant "Secret" as in password, not as in "private data". It is a private data, but it shouldn't be used as a secret to pass some security check.

Where in the article does it say that the leaked information is used as a secret to pass security checks?

You are attacking a straw man here.

Re: Vietnam Airlines Data Breach

#36

Post by skatingaway »

derwiki wrote: post #17
greatgib wrote: post #11

Testing some emails in haveibeenpwned i realized something terrible about these leaks. In isolation, ok, you have just your personal data like birthdate, name, phone number leaked just based on an email. But now that there was so many leaks, just taking a single email, you can easily map an important part of the profile of a person. Give me an email, I now have: - All identification details, sometimes scanned id docu…

Makes me feel OK about my strategy to use a different email for every sign up

You do realize if this your strategy, you must own that domain FOREVER. Whomever purchases that domain after it expires now owns all your email aliases. Assuming you do a good job of changing all your emails at every service you ever used, there is still that potential leak. Large cloud services such as google do not allow name reuse. Of course paying for a domain name forever is probably still a better idea than a provider who can be purchased, but just a reminder!!

Re: Vietnam Airlines Data Breach

#37

Post by derwiki »

skatingaway wrote: post #36
derwiki wrote: post #17

Earlier quoted context omitted.

Makes me feel OK about my strategy to use a different email for every sign up

You do realize if this your strategy, you must own that domain FOREVER. Whomever purchases that domain after it expires now owns all your email aliases. Assuming you do a good job of changing all your emails at every service you ever used, there is still that potential leak. Large cloud services such as google do not allow name reuse. Of course paying for a domain name forever is probably still a better idea than a p…

It’s a good call out. I’m glad that I used one domain instead of scattershot across all the ones I’ve owned: at least I’m only bound to renew the one domain. It’s a cheap TLD and hopefully it stays cheap!

Re: Vietnam Airlines Data Breach

#38

Post by JCharante »

zkmon wrote: post #3

Trying to understand what's the real damage here. Dates of birth, Email addresses, Loyalty program details, Names, Phone numbers - how is one going to use this data to cause a loss the data owner? If any security check depends on this data by considering it as a secret, then I guess it's the fault of that security check.

> how is one going to use this data to cause a loss the data owner?

1 email to my sister going "I have hacked into your computer and know xyz I'll spill your secrets unless you pay" was enough to make her freak out. It's all stuff that can be obtained from these leaks.

Vietnam is particularly bad with breaches. For like 25 cents you can send a telegram bot a phone number and it will immediately reply with DOB, ID number, Home Address, Facebook profiles, Instagram profiles. I know this because everyone gets a freebie and I tested it out.

Re: Vietnam Airlines Data Breach

#39

Post by JCharante »

greatgib wrote: post #11

Testing some emails in haveibeenpwned i realized something terrible about these leaks. In isolation, ok, you have just your personal data like birthdate, name, phone number leaked just based on an email. But now that there was so many leaks, just taking a single email, you can easily map an important part of the profile of a person. Give me an email, I now have: - All identification details, sometimes scanned id docu…

Vietnam is particularly bad with breaches. For about 25 cents you can send a telegram bot a phone number and it will immediately reply with DOB, ID number, Home Address, Facebook profiles, Instagram profiles. I know this because everyone gets a freebie and I tested it out. For most twenty-somethings people's home address in the leaks are their parents home in the countryside. It's a security nightmare for any girl, especially when they leave parcels containing name & phone number in the mailrooms of condo towers.
Post reply on HN