The United Nations' International Civil Aviation Organization has corroborated threat actor natohub's claimed theft of 42,000 user data records from the Montreal-based agency's recruitment database, according to The Register.
Unauthorized access to the database prompted the exfiltration of recruitment-related information from April 2016 to July 2024, including applicants' names, birthdates, email addresses, and employment history, but not their financial details, passports, credentials, and uploaded documents, said an ICAO spokesperson, who noted that none of the agency's other systems have been impacted by the incident. However, ICAO did not acknowledge natohub's purported exfiltration of individuals' home addresses, gender and marital status information, and educational backgrounds. Such a breach has already prompted ICAO to strengthen its cybersecurity defenses amid an ongoing investigation into determining individuals whose information may have been compromised. "ICAO takes the privacy and security of personal information extremely seriously. We will provide further updates as our investigation progresses," said the spokesperson.
