Passenger Hacks Into Airline’s Website To Find Lost Luggage, Company Denies Breach

A passenger allegedly hacked into the website of Indigo, an Indian low-cost airline, to track details of a fellow traveler, with whom his bag got exchanged.

"A hole (technical vulnerability) in your system," Nandan Kumar, a software engineer, wrote as he shared the details of his hacking in a Twitter thread, addressing Indigo.

According to local media reports, Kumar had traveled from the city of Patna to the city of Bengaluru on March 27, during which his bag got exchanged with that of another passenger.

"I realized it only after I reached home when my wife pointed out that the bag seems to be different from ours as we don't use key-based locks in our bags...So right after reaching home I called your customer care," he tweeted.

Kumar claimed he made several calls to the customer care team, who rejected his request of providing the contact details of the fellow passenger. The airline's customer care team cited privacy and data protection for the rejection of the request.

An agent then promised to call back after contacting the other person, but that call never came, Kumar said, according to India Today. After receiving no response, Kumar decided to take matters into his own hands, and hack the system.

"I pressed the F12 button on my computer keyboard and opened the developer console on the Indigo website and started the hole check-in flow with network log record on. And there in one of the network responses was the phone number and email id of my co-passenger. Ah this was my low-key hacker moment and the ray of hope," his tweet said.

After getting the details, Kumar called the co-passenger, who lived less than four miles away. Kumar then exchanged the baggage and arrived back home.

Kumar also said the airline never called his fellow passenger in connection with the luggage, though the agent had claimed he was contacted thrice.

A spokesperson for Indigo airline responded to the charges in a message to the New Indian Express.

"We are reviewing this case in detail and we would like to state that our IT processes are completely robust and, at no point was the Indigo website compromised. Our customer care team followed protocol by not sharing any other passenger's contact details with another passenger. This is in line with our data privacy policies," Indigo said.

The airline said the customer care team tried to facilitate the exchange of baggage, but were unsuccessful, as the calls to Kumar's co-passenger went unanswered.