Thousands of Air Canada passengers’ personal details are suspected to have been accessed in a data breach of the airline’s mobile app.
Users who had entered their passport details have been warned that they may have had data stolen.
The airline said it has now adopted improved password guidelines.
Air Canada said: “There are approximately 1.7 million Air Canada mobile app user profiles, and our investigation has determined that approximately one per cent or 20,000 profiles may potentially have been improperly accessed.
“We are contacting potentially affected customers directly.”
The carrier said is detected “unusual login behaviour” with the mobile app between August 22-24.
“We immediately took action to block these attempts and implemented additional protocols to block further repeated unauthorised attempts. As an additional security precaution, we have locked all Air Canada mobile app accounts to protect our customers’ data.
“We are also requiring all Air Canada mobile app users to re-set their passwords using improved password guidelines to further enhance security measures. A more robust password provides an extra layer of protection.”
Air Canada added: “According to the government of Canada’s passport website, the risk of a third party getting a passport in your name is low if you still have your passport, proof of citizenship, and supporting identity documents. Also according to the website, the government of Canada cannot issue a new passport to anyone based on only the information found in a passport.”
But the City of London’s Action Fraud team told the BBC that the “consequences of having your passport information accessed can be severe”.
It said banks, insurance firms and mobile phone providers were among businesses that request the data to set up accounts, but do not always require sight of the physical document.
Victims can face wrecked credit scores and bills, from which it can take months to extricate themselves.
Air Canada said in a notice on its website: “We’ve taken steps to lock down your account, and you can unlock it by following the password reset instructions in the email sent to you, or via the instructions the next time you log into your Air Canada mobile app.
“It is important to select a robust password as per our instructions when you reset your account.
“We recommend customers regularly review their financial transactions, be aware of any changes in their credit rating, and contact their financial services provider immediately if they become aware of any unusual or unauthorised transactions.”