The International Civil Aviation Organization (ICAO), a specialised agency of the United Nations, has confirmed that a data breach has affected nearly 12,000 individuals. The breach, involving the unauthorised release of recruitment-related data, was first reported last week and is currently under investigation by the agency.
ICAO, which operates with 193 member countries, disclosed that the breach relates to the release of approximately 42,000 recruitment records spanning from April 2016 to July 2024. After conducting an internal review, the organisation confirmed that 11,929 individuals were impacted by the unauthorised data exposure.
The affected data primarily includes personal details provided by applicants during ICAO’s recruitment process. This includes names, email addresses, dates of birth, and employment history. However, ICAO has clarified that no sensitive financial data, passwords, passport information, or uploaded documents were compromised in the breach.
The breach has been attributed to a hacker or group identified as Natohub, known for targeting international organisations. Natohub claimed responsibility for the release of the data, which was allegedly made public as part of the attack. ICAO is now investigating the full scope of the incident to assess the extent of the damage.
While the breach has raised concerns over the security of personal data, ICAO has assured the public that the compromised information pertains only to recruitment records. It has emphasised that there has been no indication that aviation safety or security systems were impacted by the attack.
ICAO responds to the breach
In response to the breach, ICAO has taken immediate action to enhance its cybersecurity measures and prevent further attacks. The organisation has also launched an effort to contact the affected individuals, offering support through a dedicated email address. “After completing careful review of the data, ICAO can now confirm that 11,929 individuals are affected. ICAO is now reaching out to these individuals,” stated the UN agency. “Support is being provided through a dedicated mailbox, which can be reached at mydata@icao.int.”
ICAO has stressed that the breach is limited to the recruitment database and does not extend to other critical systems within the organisation.
Its investigation into the breach is ongoing, with the organisation focusing on identifying how the attack occurred and ensuring that its systems are secure moving forward. The agency has already implemented additional security measures to strengthen its defences against future cyber threats. While the investigation continues, ICAO has guaranteed to provide updates on its findings and keep the public informed about any further developments related to the breach.
This recent data breach is not ICAO’s first encounter with cyber threats. The agency was previously targeted in 2016, after which it claimed to have made significant improvements to its cybersecurity infrastructure. The latest incident highlights the ongoing challenges international organisations face in protecting sensitive data from increasingly sophisticated cyberattacks.
Read more: US Health Department targets cyber threats with new HIPAA security proposal
