A cybersecurity incident at a third-party vendor has impacted the personal information of pilots of at least two US airlines, including American Airlines and Southwest Airlines. \n\nPersonal information, including name and social security number, driver\u2019s license number, passport number, date of birth, Airman Certificate number, and other government-issued identification numbers were compromised, according to breach notifications from the airlines.\u00a0\n\nBreach at third-party vendor\n\nOn May 3, both airlines were informed that their third-party vendor, pilotcredentials.com, had experienced a cybersecurity incident involving some files within its systems. \n\nAn unauthorized actor accessed the third-party vendor\u2019s systems on or around April 30 and obtained certain files provided by some pilot and cadet applicants during their hiring process, the airlines said in their notifications. \n\n\u201cThe incident was solely limited to the third-party vendor\u2019s systems, and no American networks or systems were affected or compromised,\u201d American Airlines said in its breach notification, adding that the investigations were launched immediately and the law enforcement authorities were notified.\u00a0\n\nPersonal information of 5,745 pilots of American Airlines and 3,009 pilots from Southwest Airlines has been leaked due to the incident, according to the airline's report to the Office of the Maine Attorney General.\n\n\u201cOur investigation determined that the data involved contained some of your personal information, such as your name and Social Security number, driver\u2019s license number, passport number, date of birth, Airman Certificate number, and other government-issued identification numbers (s),\u201d American Airlines said.\n\nSouthwest Airlines insisted there is no evidence to suggest that the affected information was targeted or misused for fraud or identity theft.\n\nMeanwhile, the two airlines have suspended the use of third-party and, moving forward, pilot applicants are being directed to an internal portal managed by the airlines. \n\nAs an additional precaution, both airlines have provided free identity protection membership that detects possible misuse of personal information.\u00a0\n\nEarlier breach reported by American Airlines\n\nIn July last year, American Airlines suffered another breach, when an unauthorized actor compromised the email accounts of a limited number of American Airlines team members. Personal information compromised in the incident included name, date of birth, mailing address, phone number, email address, driver\u2019s license, number, passport number, and certain medical information provided.\n\nThe airline also suffered a data breach in March 2021 after hackers breached SITA servers and accessed the Passenger Service System used by various airlines across the globe.