From a post over on Reddit: https://reddit.com/r/flightsim/comments/d02e9j/potential_flight1_data_breach_change_your/

2 minutes ago, Sethos said:

From a post over on Reddit: https://reddit.com/r/flightsim/comments/d02e9j/potential_flight1_data_breach_change_your/

I hate when this sort of thing happens. If true, the first people we should have heard from should have been flight1.

Of course, it seems that's never how it works.

How in the world isn't Flight1 addressing this at least directly with us via email ?

Pretty bad netizenship on their part, whether this is true or not ... 

 

Just changed my password at Flight1 and noticed my username had been changed as well.

Hi,

We got notice of this in our ticket system this morning and have been looking into it. Please note that plain passwords are not stored. Only 1-way advanced hashing of passwords are stored. We also do not save any useful card payment data (that is why you have to enter card data for each purchase). You likely do not need to change any passwords or other information (based on our preliminary examination today).

If you have any more information which could be of help post us a ticket at our site. Usernames are still the same... we auto generated usernames when doing system upgrades and they will be rather generic.

Thank you for the update, Steve.

On another note, has anyone noticed the amount of views on this thread? 177.000+ at the time of writing. Seems a tad... excessive?

2 hours ago, Sethos said:

Thank you for the update, Steve.

On another note, has anyone noticed the amount of views on this thread? 177.000+ at the time of writing. Seems a tad... excessive?

Why wouldn't anyone who has purchased at Flight1 NOT look at this thread?

22 minutes ago, yurei said:

Why wouldn't anyone who has purchased at Flight1 NOT look at this thread?

Heh, I doubt almost a quarter of a million views in a few hours is just Flight1 customers popping by. Think that would qualify the thread as one of the highest view counts on Avsim. Just found it curious and I assume there's something wrong on Avsim's end, especially with all the errors and timeouts they've been having.

Edited September 5, 20196 yr by Sethos

There is something wrong. The only way I can get into the forum is to get in via my profile activity, ie click on my last post and then click on "Hangar Chat" at the top of the page.

Chris

I received this by email

Quote

(Please do not reply to this email as this mailbox is not monitored)

Important Information:

Yesterday, September 5, 2019, Flight1 was notified that some of our customer data was found on the internet. We are posting what we have discovered.

First, Flight1 is a data-minimum company. We do not store more data than what is required to provide our service and we do not use data for marketing purposes. We do not store credit card numbers with the exception of the last 4 digits so you can inquire about a sale. Credit card expiration dates and CCV verification numbers are NOT stored. Card processing data is passed directly to the processing gateway and is not retained in our database. All flight1.com account passwords are stored as secure 1-way hash codes using an advanced algorithm. Please see our terms of service page for more details on our data policies.

What was discovered:

An audit was completed and does not show any active exploit on our server or database. We have examined our server logs going back a full year. Discovered during the audit was a script (for viewing information on a product) where logs showed there were attempts to retrieve data using an automated bot. We believe this is where some data may have been leaked. Not all current accounts were affected and yours may not have been affected. That version of the script is no longer in use and has not been in use for months. In auditing the current version of the script no vulnerabilities were found (also verified in current logs).

What you should do:

Due to the strong 1-way hashing used we do not believe it is necessary for you to change your passwords, but you are welcome to do so. Flight1 recommends you always be vigilant on the Internet. Be aware of email phishing attempts. Flight1 NEVER sends unsolicited emails asking you to log in to our site, or ask for any payment information via email..

In Summary:

Whether you have been a customer of ours for 20+ years or are a new customer, know that security is always at the top of our list and will remain so. Thank you for your support and please feel free to contact us.