FlightAware Confirms Data Leak: Here’s What You Should Know

In late July, FlightAware — the popular flight tracking website — had a data leak that exposed … well, pretty much all of your information if you have an account.

If you have a FlightAware account, here’s what you should know about this incident and steps you should take to limit the potential damage.

FlightAware Data Leak

Yesterday, FlightAware started emailing users about a data leak that occurred on July 25, 2024. Included in the email to users, the company admitted that nearly all types of data were exposed from user accounts.

On July 25, 2024, we discovered a configuration error that may have inadvertently exposed your personal information in your FlightAware account, including user ID, password, and email address. Depending on the information you provided, it may also have included your full name, billing address, shipping address, IP address, social media accounts, telephone numbers, year of birth, last four digits of your credit card number, information about aircraft owned, industry, title, pilot status (yes/no), and your account activity (such as flights viewed and comments posted).

FlightAware email to users

Beyond information related to logging into the website, the data leak includes your personal information, part of your credit card details, and even your aircraft or pilot information, if you have these and registered them on FlightAware.

What You Should Do

If you have an account with FlightAware, you should take a few steps to limit the potential effects of this leak, even if you didn’t get this email.

First, FlightAware users will need to reset their password the next time they log in to the website. However, if you’re using that same password on other websites, you should change those as well. As any social media accounts you’ve connected to FlightAware were likely exposed, you should change the password to those accounts also.

While creating a unique, complex password for every website can feel complicated, there are tools to make the process simpler. Programs like LastPass and 1Password can store your unique, difficult passwords using military-grade encryption. In this way, you can create a different password for every website, make a password that no one would ever guess, and then not worry about remembering a password like 1kzjkg5ka78#2W.

Next, consider the exposure of your address and part of your credit card number. While it’s unlikely that you’ll move to resolve this, there are a few things you can do to help here. You can notify your bank about the potential exposure of your credit card information and ask for a replacement card with a new number. Additionally, you could sign up for credit monitoring services that will notify you if someone attempts to obtain credit in your name — such as someone trying to open a credit card using the info from this data leak.

You also might consider using a VPN online in the future to hide your IP address and/or using virtual credit card numbers online so your actual card number won’t be exposed.

Final Thoughts

Unfortunately, if you have an account with FlightAware, your data may have been exposed in a leak in late July. The website didn’t notify users for several weeks, and it looks like nearly all of your data was compromised if you received an email about the incident.

Even if you didn’t receive the email, assume you were affected and take steps to secure your information and limit the effects as much as possible.