P2018-ND-052

On or about March 17, 2018, through security monitoring systems, the Organization discovered that between approximately January 1, 2018 and March 20, 2018, a now-former employee located in India was involved in diverting airline booking commissions from cheapoair.com, a branded website of the Organization. The ex-employee uploaded booking data (including personal data) from the Organization?s system into the accounts of certain web portals, such as a job board, which were potentially accessible by actors outside the company. The booking data was accessed and, in some instances, used to impersonate CheapOair agents and divert booking commissions to another travel agency.