Cyber Incident Victim: Perth Airport
Date:
Mar 2017
Location:
Australia
Summary
A skilled hacker in Vietnam used a third-party contractor's credentials to breach Perth Airport's systems, stealing sensitive security data including building schematics and physical security details. The attacker did not access aircraft operational systems or traveler personal information, and authorities confirmed no risk to public safety. The breach was detected by the airport, leading to involvement by Australian cybersecurity agencies and collaboration with Vietnamese law enforcement, resulting in the hacker's arrest and conviction. The individual, who also targeted Vietnamese infrastructure like banks and telecommunications services, acted alone without evidence of selling stolen data. The incident highlighted vulnerabilities in third-party access controls, prompting the airport to review contractor security protocols.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
In March 2017, Perth Airport's computer systems were compromised by Le Duc Hoang Hai, a 31-year-old Vietnamese national who used stolen credentials from a third-party contractor to gain unauthorized access. The breach was detected by Perth Airport staff, who promptly alerted the Australian Government’s cybersecurity center in Canberra. Investigations traced the intrusion to Vietnam, leading to collaboration between the Australian Federal Police and Vietnamese authorities. Hai exfiltrated a significant volume of sensitive data, including detailed building schematics and physical security information related to airport facilities. However, critical operational systems—such as aircraft radars and flight-related infrastructure—remained untouched, and no passenger data or personal traveler information was accessed. Authorities confirmed Hai’s actions did not jeopardize public safety or airport operations.
Vietnamese law enforcement arrested Hai following the AFP’s tip-off, and he was later convicted in a Vietnamese military court in late September 2025, receiving a four-year prison sentence. The investigation revealed Hai had targeted multiple Vietnamese entities, including banks, telecommunications firms, and a military newspaper, with Perth Airport being his sole Australian victim. Perth Airport CEO Kevin Brown stated the attacker appeared to seek credit card data but found none, and a comprehensive risk assessment confirmed no threats to passengers, staff, or partners. The incident underscored vulnerabilities in third-party contractor security, as highlighted by cybersecurity adviser Alastair MacGibbon, who praised the airport’s swift detection and response. Perth Airport subsequently reviewed contractor access protocols, while Australian officials emphasized strengthening partnerships with international allies to combat cross-border cyber threats.