“the nofly csv is almost 80mb in size and contains over 1.56 million rows of data.”
CommuteAir left a Jenkins server open to the internet. Its build workspaces held hardcoded credentials for flight and crew APIs, then AWS keys to nearly the whole infrastructure, then a 2019 copy of the TSA no-fly list sitting in test data since July 2022. A bored hacker owned the airline in about half an hour. The government handed its secret watchlist to a regional carrier, and the carrier committed it to git.