✨ The Containment Era is here. Secure AI workloads before they breach. →The Containment Era is here. →The Containment Era is here. →Explore ✨
Leisure/Travel
Breach intelligence, attack campaigns, and threat reports targeting the Leisure/Travel sector.
Explore Other Sectors
Leisure/Travel Threat Reports
WestJet Data Breach 2025: Passport Info Exposed in Major Airline Cyberattack
In June 2025, Canadian airline WestJet revealed a cybersecurity breach that resulted in the exposure of sensitive customer information, including names, dates of birth, mailing addresses, travel documents such as passports and government IDs, requested accommodations, complaints, and loyalty program data. The breach, disclosed after disruptions to internal systems and the company’s mobile app, was investigated over several months, with findings confirmed in mid-September. While no official attribution has been confirmed, the notorious Scattered Spider threat group was active in targeting the aviation industry at the time. The FBI is assisting with the investigation, and all affected customers have been notified. This breach is of significant concern as it exemplifies the intensifying targeting of travel and aviation sectors by sophisticated threat actors using advanced social engineering and credential-harvesting techniques. The incident also underscores increasing regulatory scrutiny and customer awareness around identity-related attacks and privacy risks in critical infrastructure industries.
6 months ago
Kill Chain
ComicForm and SectorJ149 Launch Formbook Infostealer Attacks in Eurasia (2025)
In April 2025, a previously unknown threat group known as ComicForm, in tandem with the SectorJ149 collective, launched a sophisticated phishing campaign against organizations in Belarus, Kazakhstan, and Russia. Exploiting spear-phishing emails, the attackers delivered Formbook malware, an advanced infostealer, to infiltrate sectors including industrial, financial, biotechnology, research, tourism, and trade. The campaign's attack chain leveraged malicious email attachments and deceptive lures aimed at harvesting sensitive credentials, exfiltrating business information, and enabling internal lateral movement, causing operational disruptions and exposing confidential data. This incident exemplifies the rise of regionally targeted malware campaigns by emerging threat actors who combine phishing, credential theft, and infostealer malware. Current threat intelligence points to increased infostealer usage, especially in sectors with valuable intellectual property, necessitating enhanced vigilance and stronger defense-in-depth strategies.
6 months ago
Kill Chain
RevengeHotels 2025: AI-Fueled VenomRAT Breach Hits Hospitality Sector
In the summer of 2025, the RevengeHotels cybercrime group (also tracked as TA558) significantly escalated its campaigns targeting the hospitality sector across Latin America, especially Brazil. Leveraging large language models (LLMs) to dynamically generate phishing lures and scripted malware loaders, the attackers delivered new VenomRAT payloads via sophisticated, invoice-themed phishing emails. These emails led hotel staff to malicious websites that dropped JavaScript and PowerShell-based loaders, ultimately granting persistent remote access for data theft and lateral movement. The attack exploited evolving tactics such as anti-kill mechanisms, registry persistence, custom encryption, and use of AI-generated code to evade detection. This incident demonstrates a marked evolution in attacker methodology, combining commodity malware, AI-driven code generation, and targeted social engineering. Such developments highlight how AI is accelerating the sophistication and reach of cyber threats, particularly in sectors with high-value payment data and limited security resources.
6 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports