Data leak

Federal Aviation Administration (FAA) Employee Data Breach (45,000 Records)

πŸ“… 2014-02-01
Primary Source β†—

Incident Details

In early 2014, the Federal Aviation Administration (FAA) suffered an unauthorized intrusion into an agency computer system that contained personally identifiable information for approximately 45,000 current and former FAA employees. The breach was discovered in February 2014 and disclosed publicly in April 2014. Exposed data included names and Social Security numbers. The FAA notified affected employees and offered credit monitoring services. The incident was part of a broader pattern of federal agency breaches during 2014-2015, during which Chinese state-sponsored actors were conducting a sustained campaign against U.S. government personnel databases. Whether this FAA breach was part of that Chinese APT campaign or a separate incident was not definitively attributed publicly. The FAA coordinated with the Department of Homeland Security and law enforcement in the investigation.

Technical Details

Initial Attack Vector
Unauthorized access to an FAA internal computer system containing employee records; the agency reported the system was accessed without authorization, though the specific technical vector was not fully disclosed publicly

Timeline

  1. 2014-02-01 Breach occurred
  2. 2014-04-15 Publicly disclosed
  3. 2014-04-15 Customers notified