---
id: 1687
title: "Hacking on a plane: Leaking data of millions and taking over any account"
source_domain: josephthacker.com
source_url: "https://josephthacker.com/hacking/2022/12/02/hacking-on-a-plane.html"
published_at: "2022-12-02T00:00:00Z"
tags: ["ai-security", "bug-bounty", "account-takeover", "data-exposure", "api-security", "idor", "writeup", "data-leak", "airline-wifi"]
phying_url: "https://phying.com/item/1687"
lang: en
---

# Hacking on a plane: Leaking data of millions and taking over any account

## Summary

Write-up of an IDOR in an in-flight WiFi provider's API: swapping the user_name, email_address, or customer_id parameter exposed tens of millions of users' data and enabled account takeover.

## Intelligence Metadata

- **Sources:** josephthacker.com
- **Published:** 2022-12-02T00:00:00Z
- **Original:** https://josephthacker.com/hacking/2022/12/02/hacking-on-a-plane.html
- **Phying News:** https://phying.com/item/1687