Chaos, confusion continues for Sunwing passengers after data security breach

Sunwing guests at Calgary International Airport were left waiting for hours Monday as a network issue knocked out the ability to check-in and board passengers. Toronto-based Sunwing said Wednesday it continues to check in passengers manually after the server networks belonging to its third-party service provider, Airline Choice, were compromised earlier this week. The disruption has grounded flights and left thousands of travellers languishing in airports at the start and end of their vacations.

Canadians stranded in sun destinations in the Caribbean, Mexico and Central America due to a data security breach affecting Sunwing Airlines Inc. say the situation on the ground is still one of chaos and confusion.

Toronto-based Sunwing said Wednesday it continues to check in passengers manually after the server networks belonging to its third-party service provider, Airline Choice, were compromised earlier this week. The disruption has grounded flights and left thousands of travellers languishing in airports at the start and end of their vacations.

"We actually thought it was nice that we got an extra night’s stay at first, but now I’m thinking this isn’t fun anymore," said Tania Cameron, a Kenora, Ont. woman who was in Varadero, Cuba, on Wednesday waiting to board a flight back to Canada.  

Cameron said she and her sister-in-law had seats on a Sunwing flight to Winnipeg that was set to depart Tuesday at 7 p.m. She said they were first notified that the flight would be delayed until midnight, and then later advised by a Sunwing representative to go back to the hotel as the flight would not be leaving until the next day.

However, Cameron said when they arrived back at the airport Wednesday, they found out the flight had left at midnight after all and they had missed it. She said she and her sister-in-law are still expecting to get home Wednesday, but only because a kind stranger heard their story and offered to give up his seats on a plane departing for Calgary.

"He was a very nice guy, his name was Paul," Cameron said. "We'll have to pay for our own flights from Calgary to Winnipeg, but I don't care. We'll figure it out. We need to get home."

Sunwing said it has subcontracted aircraft from other airlines, including WestJet, AirTransat, and Nolinor Aviation, to help relieve the backlog at some airports. The airline continues to offer affected customers the ability to make a one-time change to their departure date with no fees, for flights scheduled between April 19 and 22.

But Toronto resident Ruppi Rana said there is so little information available to passengers that it's difficult to decide what to do. He and his wife are trying to return home from Cancun, but have been unable to reach a Sunwing representative on the phone and have been relying on social media as their main source of updates.

"My wife and I, we can’t figure out when to check out, when to leave – we’ve already extended two nights at the hotel we’re at. It’s just the not knowing that is the hardest part," Rana said. "Part of us just wants to book with WestJet or Air Canada and get it over with, but that seems like a very expensive decision to make."

While Rana said he has empathy for what is a difficult situation for Sunwing and its staff, he said he's surprised the airline didn't have better contingency plans in the event of a data security problem.

"I work in software, so I'm just really surprised that they weren't better prepared," he said. "If your system gets breached, you’ve got to be on top of that.”

SUNWING CEO APOLOGIZES

In an interview with CP24 on Tuesday, Sunwing president Mark Williams apologized for the inconvenience the outage has caused, calling it a "terrible situation." 

In a statement provided to The Canadian Press Wednesday, Sunwing also expressed its regrets.

"We apologize to our customers for the ongoing delays, and thank them for their patience and understanding during this unfortunate situation," the company said, adding further updates on the system outage will be communicated to customers as the situation evolves.

'DATA-SECURITY EVENT'

Airline Choice — the third party whose systems were breached — is an Illinois-based company that provides airlines with a technological platform aimed at streamlining the passenger handling, self-service and compliance process.

In an emailed statement Wednesday, Airline Choice described the breach as a "data security event" that affected a limited number of its computer systems.

"As a precaution, we took certain systems offline to secure our environment. We also immediately launched an investigation to determine the nature and scope of the event," the company said.

Airline Choice added it has already begun restoring functionality to its systems and will be working around the clock until that is complete.

Sunwing said the server issue has impacted several carriers globally. Robert Kokonis, president and managing partner of independent aviation consultancy AirTrav Inc., said the issue highlights the vulnerability to cyberattack of not just airlines, but major companies in all industries.

"Any modern company that's heavily reliant on IT systems has to have a very robust backup plan, because cyber threats are going to just keep coming. There's no end to them," Kokonis said. "As a result of this, not just Sunwing, but every other airline elsewhere in Canada, will be taking a look at their backup measures."

Sunwing passengers whose flights have been delayed by more than three hours may be entitled to compensation under federal air passenger protection regulations. 

This report by The Canadian Press was first published April 20, 2022.