AI Pentest Tool Penligent sur la violation de l'aéroport de Dublin : Ransomware Everest, exposition de la chaîne d'approvisionnement MUSE et risque pour les passagers

Executive Summary

A Russia-linked extortion group known as Everest claims it stole 1,533,900+ passenger records tied to Dublin Airport. The group published Dublin Airport on its leak site with a countdown timer, threatening to release the data unless contacted.(BankInfoSecurity)

The data allegedly comes from systems linked to Collins Aerospace’s MUSE / vMUSE check-in and boarding platform, which is widely deployed across European airports to let multiple airlines share desks, gates, and boarding infrastructure.(BankInfoSecurity) Collins Aerospace suffered a cyberattack in September 2025 that disrupted automated check-in at hubs including Dublin, Heathrow, Brussels, and Berlin, forcing manual fallback.(heise online) Now the impact has moved from operational chaos to alleged mass data exposure.

Everest says the stolen dataset includes passenger names, ticket numbers, seat assignments, flight segments, frequent flyer numbers, timestamps, workstation/device IDs used for boarding pass issuance, and even security-screening indicators such as “Selectee” flags and document verification status.(BankInfoSecurity) This is not generic PII. This is flight operations metadata, which can be directly weaponized for targeted phishing, account takeover of loyalty programs, identity abuse, and social engineering against airport staff.(BankInfoSecurity)

Dublin Airport’s operator, daa, has said there is “no evidence” that daa’s own systems were directly compromised; instead, the breach is attributed to a third-party supplier — Collins Aerospace — and appears to involve boarding pass and check-in data for passengers who traveled through Dublin Airport in August 2025.(BankInfoSecurity) Regulators, including Ireland’s Data Protection Commission, have been notified and are actively engaged.(RTÉ)

Penligent’s stance is straightforward: this is exactly the scenario modern aviation and travel organizations must be testing in advance. Penligent’s role is to simulate attacker behavior against these passenger and operational data flows — under authorization — and then generate compliance-grade reports that map exposure to regulatory duties such as GDPR breach notification timelines. Penligent does not fix production infrastructure, monitor dark web chatter, or act as an MSSP. It focuses on controlled penetration testing and compliance-ready reporting.

What Everest Says It Has — and Why It Matters

Claimed scope of the breach

Everest claims it exfiltrated approximately 1,533,900 passenger-related records and posted Dublin Airport as a named victim on its leak / extortion site, alongside Air Arabia.(BankInfoSecurity) The listing was published with a countdown timer, a classic “double extortion” move: pay or negotiate before the timer expires, or we leak.(BankInfoSecurity)

Public reporting and screenshots of Everest’s post describe data fields that go well beyond “name + email”:

• Full name
• Ticket / booking / PNR-like reference numbers
• Seat assignment, travel class / compartment, segment sequence
• Flight number, departure and destination airport codes, timestamps
• Frequent flyer program, loyalty number, tier/status
• Priority / fast-track indicators and baggage tag numbers
• Boarding pass barcode format and issuance metadata
• Device / workstation ID, device name, and device type used to issue the boarding pass
• “Selectee” indicator and international document verification status (i.e. screening / security flags)
• Source of check-in and source of boarding pass issuance (desk, kiosk, gate, etc.)(BankInfoSecurity)

This matters because it intersects three threat planes at once:

1. Targeted phishing and social engineering
   If an attacker knows you flew Dublin → Brussels on August 14, seat 22C, and that you were flagged for document verification, they can impersonate airline security or airport customer care and “need to revalidate your passport before your return leg.” That phishing email or call is going to land at >90% credibility with a normal traveler.(BankInfoSecurity)
2. Loyalty and mileage fraud
   Frequent flyer numbers and tier status are financially valuable. Attackers routinely use loyalty credentials to redeem miles, upgrade tickets, or social-engineer call centers. Stolen loyalty data has historically been abused without ever breaching a bank account — it’s already liquid value.
3. Operational reconnaissance
   Workstation IDs and boarding-pass issuance device names let an attacker craft internal-looking phishing aimed at airport ground staff (“Security audit for workstation G12 on Sept 21 — open attached diagnostic tool”). That’s a bridge from “steal passenger data” to “compromise airport operations.”(BankInfoSecurity)

Who is affected, time window, and scale

daa said the compromised data appears to cover passengers who departed Dublin Airport between August 1 and August 31, 2025.(BankInfoSecurity) August is peak traffic: Dublin handled roughly millions of passengers that month.(BeyondMachines)

daa also stated that its own internal systems are not confirmed breached, framing this as a supplier incident (Collins Aerospace / MUSE).(BankInfoSecurity) That distinction matters internally for blame, but from a regulator’s perspective, passengers do not care which box was hacked. If their data is exposed, both data controller and processor land in the compliance blast radius.

MUSE / vMUSE as a Supply Chain Weak Poin

One failure, multiple airports

Collins Aerospace’s MUSE (often referred to as vMUSE) is common-use passenger processing: shared check-in desks, bag drop, and boarding gates across multiple airlines and, in practice, multiple airports.(BankInfoSecurity) When attackers hit that layer in September 2025, automated passenger handling broke at major European hubs — Heathrow, Brussels, Berlin, Dublin — forcing manual boarding, handwritten fallback, and cascading delays.(heise online)

Everest now claims it did more than disrupt check-in: it says it accessed an exposed Collins Aerospace FTP server with weak credentials, pulled passenger and operational data, and then used extortion rather than pure ransomware encryption.(BankInfoSecurity) If true, that means (a) long-term credential reuse and (b) inadequate isolation of high-value operational data.

Third-party breach ≠ zero liability

daa has said “our core systems weren’t hit,” and Collins Aerospace is under investigation.(BankInfoSecurity) Under GDPR-style rules, that isn’t enough. If identifiable passenger data and security screening information left a supplier environment, the airport operator still faces regulatory duties: notify authorities within 72 hours of awareness and alert affected individuals “without undue delay” if there is high risk to them.(RTÉ)

In other words: “the vendor got hacked” does not save you from breach reporting, brand damage, or litigation.

How Attackers Can Weaponize the Stolen Fields

Below is a focused risk matrix based on the data types Everest claims to have.(BankInfoSecurity)

This is what makes this breach different from a generic email/password dump. A motivated attacker can now:

• impersonate you to an airline, because they know your booking details better than you do;
• impersonate the airline to you, because they know your exact seat and timestamp;
• pivot into airport operations by imitating internal device/audit language.

Immediate Response Expectations for Airport Operators and Airlines

Containment and evidence

The first move after a breach like this is not PR. It’s scope confirmation and evidence preservation:

• Which date ranges are affected (daa has pointed to August 1–31, 2025)?(BankInfoSecurity)
• Which carriers and which terminals used the compromised MUSE / vMUSE workflows?(heise online)
• Which passenger segments (VIP, premium, government, corporate) are at greatest downstream fraud risk?
• What internal workstation IDs, gate IDs, or device identifiers are now burned and must be rotated?

All of that must be documented, because European data protection authorities and cyber insurers will ask for a timeline, not a press quote.(RTÉ)

A typical internal enrichment workflow looks like this:

# pseudo-logic: prioritize outreach for high-risk passengers
for rec in leaked_passenger_records:
    if rec.frequent_flyer_tier in ["Gold","Platinum","VIP"] or rec.ticket_price > HIGH_VALUE:
        escalate_to_manual_review(rec.pnr, rec.name, rec.flight_route)
        flag_for_proactive_notification(rec.email)

This is how you move from blanket “Dear customer, maybe you were exposed” messaging to targeted, defensible risk notifications.

Passenger notification and fraud watch

daa has already told August 2025 travelers to watch for suspicious booking changes or unusual itinerary activity, which is essentially an early fraud advisory.(BankInfoSecurity) That aligns with GDPR expectations: if there is “high risk” to affected individuals — identity theft, targeted phishing, loyalty theft — you notify them “without undue delay.”

Hardening of support flows

Airline call centers and loyalty desks must stop treating PNR + last name + flight date as proof of identity. After an incident like this, that combo is public to attackers. They need secondary checks (out-of-band confirmation, MFA on loyalty accounts, or controlled callbacks).

Where Penligent Fits (and Where It Doesn’t)

Penligent is an AI-driven penetration testing tool. Its purpose in this context is twofold:

1. Simulate attacker behavior against your environment, with authorization.
   Penligent can stage controlled attack exercises that mirror what Everest claims to have done: use leaked-style booking data, frequent flyer IDs, seat assignments, workstation IDs, etc., and attempt (in a test environment) to navigate support flows, loyalty access, or ground operations workflows. The goal is to see whether an attacker could socially engineer their way into account changes, itinerary modifications, or operational access using only the kinds of fields exposed here.(BankInfoSecurity) In other words, Penligent answers: “If someone shows up with booking reference XYZ123 and seat 22C from August 14, can they trick us into reissuing boarding credentials or touching loyalty balances?”
2. Generate compliance-aligned reporting.
   After the simulation, Penligent produces structured reporting that maps the identified abuse paths to regulatory and disclosure duties. This includes:
   • Which data elements are sufficient to impersonate a traveler or access loyalty value
   • Which workflows fail basic verification or violate least-privilege assumptions
   • Which issues would trigger GDPR-style breach notification timelines (72-hour authority notice, ‘undue delay’ user notice) if they were exploited against live passengers.

What Penligent does pas do:

• It does not run your SOC, provide 24/7 monitoring, or do live dark web surveillance.
• It does not claim to repair Collins Aerospace’s infrastructure or harden MUSE.
• It does not guarantee containment.

Instead, Penligent gives CISOs, airport operators, and airline security leads a controlled rehearsal of the exact social-engineering and data-abuse moves attackers would try next — and a report they can hand to legal and compliance.

What Passengers Should Do

Even if you’re “just a traveler,” this leak is not abstract:

• Be skeptical of any message that cites your exact August 2025 itinerary, seat, or flight number and asks for passport images, ID revalidation, or immediate payment. That level of detail is now potentially in criminal hands.(BankInfoSecurity)
• Lock down your frequent flyer account: turn on MFA, change your password, and monitor point/mileage redemptions. Loyalty fraud is low-friction cash-out.
• Watch for unauthorized rebookings or refunds under your name. daa explicitly warned August travelers to monitor for unusual booking activity.(BankInfoSecurity)
• If you’re high-tier status or a corporate / government traveler, assume you are high-priority for targeted phishing.

Closing View

The Dublin Airport incident is not a routine “data breach” story. It’s a supply chain compromise of Collins Aerospace’s MUSE/vMUSE passenger processing layer, which already caused physical airport disruption across Europe in September 2025.(heise online) It’s an extortion play, with Everest publicly listing Dublin Airport and starting a countdown.(BankInfoSecurity) And it’s an exposure of operationally sensitive passenger data — seat assignments, PNR references, loyalty tiers, even workstation IDs — for roughly 1.5 million records.(BankInfoSecurity)

For aviation operators, this is now the baseline threat model:

• Your third-party check-in/boarding stack is a national-scale single point of failure.(heise online)
• Passenger data is not just “PII,” it’s live social-engineering ammunition.(BankInfoSecurity)
• Regulators expect evidence, timelines, and passenger notification inside 72 hours, even if “it was the vendor.”(RTÉ)

Penligent’s role is to help you rehearse that exact scenario under controlled conditions — simulate the attacker’s next move against your support and identity flows, then hand you a compliance-ready report that shows which flows fail, which identities can be hijacked, and how fast you’re obligated to notify.

In 2025, that’s not “nice to have.” For airports and airlines, that’s table stakes.