erhan

[erhan @erhanyil_]

Geçmiş Olsun...

[Dark Web Intelligence @DailyDarkWeb]

🇹🇷 🚨 TURKEY: PEGASUS AIRLINES ALLEGEDLY BREACHED, 173GB OF INTERNAL AND CUSTOMER DATA CLAIMED ON DARK WEB FORUM

A threat actor on a dark web forum claims to have accessed Pegasus Airlines' Jira and Confluence servers, and later its AWS environment.

The allegedly stolen data includes:
• ~430K Jira support tickets with comments and attachments
• ~37K Confluence files, including internal employee guides
• ~18K employee names and email addresses
• Customer data said to include booking records (PNR), flight details, names, national ID and passport numbers, emails and phone numbers
• About 173GB in total

The claim has not been independently verified.

⚠️ Analyst Note:
Unverified threat-actor claim, NOT confirmation of a breach. The screenshot shows what looks like an internal Jira service desk, but customer PII was not visible in the post. If authentic, passengers face targeted phishing using real booking details, and KVKK (Turkey's data protection law) and GDPR notification duties may apply.

Source: this is for subscribers only. Subscribe: https://t.co/O5fslMgNk4

#DDW #DarkWeb #Turkey #PegasusAirlines #DataBreach #Aviation #ThreatIntelligence #CyberSecurity

[erhan @erhanyil_]

@_jensec @Bugcrowd Same experience here with @Bugcrowd. A report sat in the queue for 2 months, then got closed as a false positive because the retest skipped the key step. If you don’t follow the steps, of course it won’t reproduce. That’s not a false positive.