Overview

• Scattered Spider has moved from retail and insurance into aviation and transportation, marking a sector-by-sector escalation in its hacking campaign.
• WestJet disclosed a June 12 breach that disrupted internal services and its mobile app after attackers exploited self-service password resets to add unauthorized MFA devices.
• Hawaiian Airlines reported a June 23 intrusion affecting select IT systems and said flight operations and passenger safety remained unaffected.
• American Airlines is grappling with an IT outage of unclear origin during a surge of suspected Scattered Spider incidents in the airline ecosystem.
• FBI, Mandiant and Palo Alto Networks’ Unit 42 have called on airlines and their contractors to fortify help desk identity verification, bolster multi-factor authentication and ban unauthorized MFA device enrollments.