Norwegian cruise line had a similar thing recently with emails going out with actual booking information. Basically identical to the frontier scam emails. I wonder if there’s some customer service software that’s being exploited that they both use.
It seems early to speculate, but if this is related to the massive uptick in CVEs we've been seeing recently it feels like we're actively witnessing a corporate reckoning around security posture the likes of which has never occurred.
I'm not sure there will be corporate reckoning. Unless security breaches come with business impacting consequences, they will continue to ignore it and just pay out occasional class action lawsuit.
I’ve been increasingly going with Delta regardless of price because of their tech being at least somewhat usable. I might even be inclined to switch to another carrier if they were to make entirely api-based (personal) access available for flight management and searching/booking (probably via MCP given the current climate, but I’ll take what I can get).
I agree for data loss and ransomware where the ransom is paid, ie economically driven attacks. I wouldn’t agree when the hack is designed to kill the business destructively and no economic gain is sought or intended.
The difference in attack methodology is trivial, from a threat actor perspective, imho.
- On October 14, 2026 (UTC), an external attacker gained unauthorized access to Zeabur's internal systems and some customer services. We began our emergency response as soon as we detected the unusual activity. We have confirmed that this incident affected a broader scope than the incident in late August...Having another security incident in such a short time has let down the people who trusted us. Protecting your services and data is our responsibility, and we have fallen short.
Engineers aren't a help if they have poor inuition and insight into security concerns themselves, which is true for almost all of them.
Filling departments with inexperienced people based on how well they can recall a classic algorithm on a whiteboard was never the set up for a secure software or IT ecosystem. Peers watching in shock and dismay as supply chain risk escalated year over year for the last decade, among other horrifying practices, have been crying over this all along.
They might be able to follow an AI lead better than someone even less technical, but it's unclear that doing without true expertise as an oversight and check would cut it.
Having walked ourselves into it long before AI appeared, We're set up for a dark time with few easy outs.
I have a more nuanced take on this, which is that many engineers may have decent intuition on security - but that's entirely besides the point here, because without the political capital to have a large organization (and their customers and counterparties!) change their workflows and security stances, they're tilting at windmills. Security is not one of those things that one can throw bodies at - it requires true attention and commitment from leadership, and time to percolate across every facet of a company. If such a mandate is in place, talent is far from the limiting factor.
I did AppSec for a couple of years just for a change of pace. The friend who worked there said they wanted to strengthen their infosec program in general, which is why they wanted to hire an SWE for AppSec instead of using cyber boot camp grads like they had been. Turned out 90% of infosec is about creating all of the necessary paperwork to protect to company from liability if there's a breach. Actual security issues were ignored most of the time if there wasn't a compliance framework that addressed the vuln directly. We could have tripled the number of people in the department and it wouldn't have made any difference in terms of actual security. Maybe the compliance paperwork would have been submitted a bit sooner.
The "All modern digital infrastructure" xkcd (https://xkcd.com/2347/) where they had a fragile tower of blocks needs an update where those blocks are now collapsed on the floor in a complete mess.
> it feels like we're actively witnessing a corporate reckoning around security posture the likes of which has never occurred.
As a cyber person, I agree. The theater has met reality, and those who put in the work will have an easier time than those who just checked a box. Good luck to all actively responding.
Safety alignment feels like an absolute farce and the completely wrong approach too. These things are guns, or attack dogs. We've never succeeded at reigning in software with this approach in the past, besides maybe DRM, which is itself laughable under many circumstances. This has the unprecedented ability to entertain the base desires of most juvenile threat actors, which is to get a big payout with minimal effort (let alone the pre-existing sophisticated attackers, who are now basically gods). Now we have a turn-key tool that can leverage and chain the most minute vulnerabilities up the ladder to full compromise or discover zero days with unyielding dedication. It feels like it almost makes CVE level classification moot.
As someone who red teams with open weight models (GLM 5.3 currently) and a domain focused harness, I would agree with this. No regulation will prevent a sufficiently capable open model, nor stop the development of open models. Alignment efforts are “please don’t stop us from selling stock to the unsophisticated” imho. They aren’t stopping anyone competent and/or capable from model development and training.
My guess is something related to looking up Frontier flight status was abused to enumerate all active flight itineraries.
If Frontier had been completely breached and all data compromised, there's likely more lucrative things the attacker can do than just using the data to enhance their credit card stealing phishing attack.
Earlier this year, Frontier was one of the orgs that got their data leaked thanks to incorrectly configured security settings on their Microsoft Power Pages based website. While this is unlikely to be the source for current flight confirmation numbers, such data could sure help in phishing operations.
https://en.wikipedia.org/wiki/Jaguar_Land_Rover_cyberattack
Of course they then blame "state sponsored" attackers.
https://www.techdigest.tv/2026/10/former-minister-confirms-j...
The difference in attack methodology is trivial, from a threat actor perspective, imho.
- On October 14, 2026 (UTC), an external attacker gained unauthorized access to Zeabur's internal systems and some customer services. We began our emergency response as soon as we detected the unusual activity. We have confirmed that this incident affected a broader scope than the incident in late August...Having another security incident in such a short time has let down the people who trusted us. Protecting your services and data is our responsibility, and we have fallen short.
The end of the road – OSGrid shutting down due to attack - https://news.ycombinator.com/item?id=50060854 - October 2026
7 Companies Forced to Shut Down After a Data Breach - https://n2ws.com/blog/5-companies-shut-down-data-breaches - March 4th, 2025
(if others have more examples, I am collecting them, please drop them in a reply)
Filling departments with inexperienced people based on how well they can recall a classic algorithm on a whiteboard was never the set up for a secure software or IT ecosystem. Peers watching in shock and dismay as supply chain risk escalated year over year for the last decade, among other horrifying practices, have been crying over this all along.
They might be able to follow an AI lead better than someone even less technical, but it's unclear that doing without true expertise as an oversight and check would cut it.
Having walked ourselves into it long before AI appeared, We're set up for a dark time with few easy outs.
https://hn.algolia.com/?dateRange=all&page=0&prefix=false&qu...
https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que...
> it feels like we're actively witnessing a corporate reckoning around security posture the likes of which has never occurred.
As a cyber person, I agree. The theater has met reality, and those who put in the work will have an easier time than those who just checked a box. Good luck to all actively responding.
If Frontier had been completely breached and all data compromised, there's likely more lucrative things the attacker can do than just using the data to enhance their credit card stealing phishing attack.
https://venarix.com/blog/exfilsquad-targets-misconfigured-mi...
Stay safe guys.