Sunwing deals with delays for third day, blames cyber breach

A technical problem at Sunwing Airlines that continues to ground flights is being blamed on a data security breach at the company’s third-party provider.

“A system that is up and running all the time, which never fails, was hacked,” said Sunwing President Mark Williams. “They had a cyber-breach and they’ve been unable to get the system up.”

As a result, the company has been forced to check-in passengers manually, causing significant delays at airports across Canada as well as in sun destinations.

“It’s been delayed eight times,” said one woman at Pearson International Airport in Toronto. “We’ve been shuffled to three hotels.”

Amid the chaos, those affected by the outage have been left with little information about when this might be resolved.

“There's no answers,” said another traveller in Toronto. “There's a lack of communication.”

Aviation authorities in both Canada and United States want to ensure the system, provided by Chicago-based Airline Choice, is secure before it is reactivated.

In an e-mailed statement to The Canadian Press on Wednesday, Airline Choice described the breach as a “data security event” that affected a limited number of its computer systems.

“As a precaution, we took certain systems offline to secure our environment. We also immediately launched an investigation to determine the nature and scope of the event,” the company said.

Neither Airline Choice nor Sunwing have been able to provide any timeline in terms of when the system will be back up and running. Sunwing says it is working with other airlines to source additional planes and to help relieve some of the backlog in airports.

Cyber security expert Ritesh Kotak says this incident is an example of why companies need to have a back-up plan when it comes to the technology it relies on.

“What happens when the lights get turned off,” he said. “How do you ensure you have business continuity and ensure that your processes are safe and secure and business can actually continue?”

“It seems like they probably didn't have proper processes in place and as a result you're seeing this delay probably get further extended.”

Airline Choice said it has begun restoring some functionality to its systems and is working around the clock to restore service for its clients, which include dozens of airlines and cargo companies around the world.

But Aviation Expert John Gradek says Sunwing is just as to blame as its third party for what’s happened over the last three days.

“You have to make sure that you as a buyer vet the capabilities and the functionality of what you’re buying,” he said. “That includes understanding what safeguards are in place to ensure these sorts of attacks are mitigated. It just seems our friends at Sunwing were just not prepared.”

Cyber threats are something companies must continually prepare for, Gradek says.

“It’s not a question of if you are going to get hacked,” he said. “It’s a question of when. And every organization dealing with e-commerce is going to get hacked at a certain point in time.”

Gradek added that he believes the fiasco lies with Sunwing, but that the company will get through it.

“I think this is not going to be the end of Sunwing, it's going to be a little bit of a hiccup along the way,” he said. “Unfortunately, thousands of Canadians are going to be affected.”

Sunwing has promised all passengers delayed over three hours will be compensated. They are also allowing passengers flying between April 19 and April 22 to change their travel dates without penalty, but they must travel by June 23, 2022.