Plane tracker FlightAware admits user passwords, SSNs exposed for years

FlightAware disclosed a prolonged configuration error that potentially exposed user personal information — including user IDs, emails, names, addresses, IPs, phone numbers, account activity, last four credit-card digits, and other PII — from January 1, 2021 until discovery on July 25, 2024; the company fixed the issue, required password resets, offered two years of Equifax monitoring, and later stated only 16 SSNs were potentially exposed and that stored passwords were hashed and salted, though it did not confirm whether data was accessed by unauthorized parties.