Hacker group "Bashe" claims to have stolen data from Vienna Airport

Airport's response

Vienna Airport has reacted immediately to the incident and launched internal and external investigations. "Der Flughafen Wien arbeitet an der Aufklärung dieses Sachverhalts, ist mit den zuständigen Behörden in Kontakt und hat zusätzlich zur eigenen IT-Abteilung auch externe Cybersecurity-Experten hinzugezogen", Kleemann explained. The authorities have been informed according to their own statements, and the exact scope of the incident is currently being examined.

The hacker group "Bashe" claims to have captured a large number of data sets and to be offering them for sale on the darknet. Independent IT security experts and "Der Standard" have, however, expressed doubts about the credibility of this account. Such exaggerations are a common means of artificially driving up the selling price of stolen data or generating attention.

Doubts about the account

According to the airport's current state of knowledge, passenger-related data is not affected. Flughafen Wien AG operates the airport in Schwechat, which as Austria's largest airport handles millions of passengers annually. A data leak would therefore have not only economic but also security-related and data protection consequences.

The incident assessment is set against the backdrop of a growing threat situation for critical infrastructure in Europe. Airports, energy suppliers, and public administrations have increasingly been in the sights of professional hacker groups for years. This often involves extortion, espionage, or the sale of stolen data on criminal online marketplaces.

Possible consequences

The "Bashe" group's claim has not been independently verified so far. Neither the APA nor other Austrian authorities have confirmed the theft of the alleged 500,000 emails. The ongoing investigations are intended to clarify whether sensitive data has actually been exfiltrated or whether, as the airport suggests, it is a mixture of old material and exaggeration.

Vienna Airport announced that it would continue to process the matter transparently and take further steps if necessary. Should the data leak turn out to be more serious than previously stated, possible consequences would include criminal complaints, claims for damages, and a notification obligation under the General Data Protection Regulation. Until then, it remains to be seen what the forensic analysis reveals.