{"id":645686,"date":"2026-05-06T13:01:41","date_gmt":"2026-05-06T11:01:41","guid":{"rendered":"https:\/\/mybroadband.co.za\/news\/?p=645686"},"modified":"2026-05-06T13:07:18","modified_gmt":"2026-05-06T11:07:18","slug":"flysafair-leaked-peoples-private-information-during-r12-ticket-birthday-sale","status":"publish","type":"post","link":"https:\/\/mybroadband.co.za\/news\/security\/645686-flysafair-leaked-peoples-private-information-during-r12-ticket-birthday-sale.html","title":{"rendered":"FlySafair leaked people’s private information during R12 ticket birthday sale"},"content":{"rendered":"\n

Popular low-cost South African airline FlySafair leaked the private information of users participating in its highly anticipated R12-a-ticket birthday sale on Wednesday.<\/p>\n\n\n\n

MyBroadband was informed that the sale site\u2019s bulletin chat API could easily be accessed and that it was providing details of users participating in the sale, including names and email addresses.<\/p>\n\n\n\n

We immediately notified FlySafair representatives, who told us the airline\u2019s staff were actively working to take down the chat\u2019s API.<\/p>\n\n\n\n

Since the official start of the sale at 9:00 on Wednesday until the moment we were first informed that the chat bulletin board was taken offline, user data was accessible for 1 hour and 39 minutes.<\/p>\n\n\n\n

During that time, the API showed the full names, email addresses and IP addresses of anyone who posted messages to it. The API also indicated whether a poster was a winner.<\/p>\n\n\n\n

The API through which the information was leaked was part of a new feature that was added to the portal for this year\u2019s sale. Previously, the site pulled a live feed from Twitter\/X.<\/p>\n\n\n\n

\u201cWe wanted something a bit more controlled and engaging this time around,\u201d said Kirby Gordon, FlySafair spokesperson and chief marketing officer.<\/p>\n\n\n\n

FlySafair confirmed that it had removed the chat board at 11:20 and that the API data had been cleared, including the email and IP addresses.<\/p>\n\n\n\n

Gordon indicated that the sale was not affected by the removal of the chat feature and that every other part of the process remained \u201cstatus quo\u201d.<\/p>\n\n\n\n

\u201cIt\u2019s something we\u2019ll be reviewing with our technology partners as an urgent priority because what happened is entirely unacceptable,\u201d he told MyBroadband.<\/p>\n\n\n\n

\u201cA full post-mortem process will follow once the live operational environment has quietened, with a clear focus on understanding exactly where the failures occurred.\u201d<\/p>\n\n\n\n

The airline will also identify actions required to prevent a repeat of the issue, but Gordon said the immediate priority was supporting customers and ensuring the sale continues to operate.<\/p>\n\n\n\n

Oil prices cast cloud over highly anticipated sale<\/h2>\n\n\n\n
\"\"\n\t\t\t\n\t\t\t\t\n\t\t\t<\/svg>\n\t\t<\/button>
Sample of the chat API that leaked user information. Private user information has been removed. <\/figcaption><\/figure>\n\n\n\n

While the API was accessible, users could see their position in the waiting queue for entry in the R12 ticket competition.<\/p>\n\n\n\n

We saw that more than 594,000 people were in the queue around 10:30, with likely thousands more taking part throughout the sale.<\/p>\n\n\n\n

The usual excitement over the sale was subdued this year, as many South Africans who hoped to purchase tickets posted their disappointment on social media about prices exceeding R12.<\/p>\n\n\n\n

This year, the airline said it was forced to add surcharges and taxes to the R12 ticket prices, driven by the international fuel crisis and jet fuel costs in South Africa.<\/p>\n\n\n\n

\u201cAs a result, the fares this year are not R12 all-in as they were previously, but rather R12 excluding taxes and surcharges,\u201d explained Gordon.<\/p>\n\n\n\n

\u201cIt\u2019s still an exceptionally strong deal, but we\u2019re no longer in a position where we can effectively subsidise the taxes and fuel-related components of the ticket as well.\u201d<\/p>\n\n\n\n

According to a full breakdown of ticket prices, although the base ticket price is R12, taxes and surcharges can push prices over R1,183.<\/p>\n\n\n\n

This can double if return tickets are also purchased, with one user posting online that their full ticket price went up to R3,647.32 for flights to and from Cape Town and Johannesburg.<\/p>\n\n\n\n

In April, FlySafair explained that it adjusted the surcharge on tickets weekly to reflect fluctuations in fuel prices. It recently decreased the additional costs for two weeks in a row.<\/p>\n\n\n\n

\u201cThe surcharge is not a revenue mechanism, it moves directly with our actual fuel costs,\u201d said Gordon.<\/p>\n\n\n\n

\n\n\n\n

Screenshot of FlySafair chat board API leak<\/h2>\n\n\n\n
\"\"<\/a>
User information accessible through the chat API. Screenshot from @lethiakx on X\/Twitter<\/a>.<\/figcaption><\/figure>\n","protected":false},"excerpt":{"rendered":"

FlySafair accidentally leaked the private information of contestants, including email addresses, who took part in its popular R12 a ticket sale. <\/p>\n","protected":false},"author":341213,"featured_media":645701,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[27],"tags":[14673,105038,32430,105033,69655,60031,405],"class_list":["post-645686","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-security","tag-api","tag-email-leak","tag-flysafair","tag-flysafair-birthday-sale","tag-kirby-gordon","tag-leaks","tag-twitter"],"_links":{"self":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts\/645686"}],"collection":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/users\/341213"}],"replies":[{"embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/comments?post=645686"}],"version-history":[{"count":8,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts\/645686\/revisions"}],"predecessor-version":[{"id":645723,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts\/645686\/revisions\/645723"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/media\/645701"}],"wp:attachment":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/media?parent=645686"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/categories?post=645686"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/tags?post=645686"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}