Skip to main content
    Customer Support Vendor

    Delta Air Lines 24/7.ai Vendor Breach (2018)

    Breach Year

    2018

    Breach Type

    Customer Support Vendor

    TPRM Lesson

    Customer support chat scripts can capture payment data.

    What was the Delta Air Lines 24/7.ai Vendor Breach breach?

    The Delta Air Lines 24/7.ai breach was a 2018 incident in which attackers modified the online chat software that Delta and other brands ran from vendor 24/7.ai, capturing payment card data submitted through delta.com during a five-week window.

    On this page

    1. What Was It?
    2. What Happened?
    3. How Did It Happen Technically?
    4. Why This Was a TPRM Failure
    5. Business Impact
    6. Consequences
    7. What Most People Miss About This Breach
    8. Practical TPRM Lessons
    9. Technical Protection Checklist
    10. Final TPRM Takeaway
    11. FAQ
    12. Public Sources Reviewed

    Delta is the case that showed the customer support chat widget is a payment surface.

    In autumn 2017 attackers compromised 24/7.ai, a customer service software vendor whose chat product was embedded on major airline, retail and financial websites.

    For roughly five weeks the modified chat code captured payment card, name and address data entered on delta.com. Delta disclosed the breach in April 2018.

    What Was It?

    A compromise of a vendor-hosted chat script that ran on the payment path of delta.com and other brand sites.

    What Happened?

    26 September 2017. Malicious code entered 24/7.ai's chat product.

    12 October 2017. Attackers were removed from the vendor environment.

    April 2018. Delta and Sears publicly disclosed the incident.

    How Did It Happen Technically?

    • Attackers modified the vendor's chat JavaScript to capture form data.
    • Because the chat widget was embedded on payment pages, it had DOM access to card fields.
    • Delta had no independent monitoring of vendor script content.
    • The compromise sat inside a shared multi-tenant SaaS, so multiple brands were hit together.

    Why This Was a TPRM Failure

    • Chat vendor unclassified as payment-critical. The chat script lived on payment pages with no additional controls.
    • No client-side integrity check. Delta had no SRI or CSP on the chat script.
    • Shared SaaS blast radius. One vendor compromise hit Delta, Sears and Best Buy at once.
    • Slow detection. Five weeks of skimming before vendor discovery.
    • Delayed notification. Six months between remediation and public disclosure.

    Business Impact

    • Hundreds of thousands of Delta customers notified.
    • Class actions filed against Delta and 24/7.ai.
    • Regulatory scrutiny of third-party chat vendors across airline and retail sectors.

    Consequences

    The case pushed regulated brands to treat customer support scripts as PCI-adjacent and to demand vendor-side change monitoring.

    What Most People Miss About This Breach

    Nothing on delta.com was hacked. The chat vendor was. But because chat ran on the payment page, the exposure was Delta's.

    Practical TPRM Lessons

    1. Treat chat vendors on payment pages as payment vendors.
    2. Restrict chat scripts from DOM access to card fields.
    3. Enforce CSP and SRI on vendor scripts.
    4. Require vendor notification within hours, not months.
    5. Load chat asynchronously from an isolated container.
    6. Include shared-SaaS blast radius in vendor tiering.
    7. Rehearse coordinated brand disclosure.
    8. Audit vendor build and deployment integrity annually.

    Technical Protection Checklist

    A. Identity and Access. MFA on the vendor's build and deployment pipeline.

    B. SaaS and API Integrations. Chat script isolated from card DOM.

    C. Software Supply Chain. SRI on every third-party script.

    D. File Transfer and Data Exchange. CSP allowlist of exfil destinations.

    E. Data Protection. Hosted card fields in an iframe outside chat scope.

    F. Vendor Incident Response. Hours-scale notification contracted.

    G. Fourth-Party Risk. Vendor sub-processors disclosed and assessed.

    H. Board and Executive Reporting. Client-side vendor risk reported quarterly.

    Final TPRM Takeaway

    "If your chat vendor can read the card field, your chat vendor is your card processor."

    Frequently Asked Questions

    What was the Delta 24/7.ai breach?

    A 2018 disclosure of a 2017 compromise of 24/7.ai's chat software that captured Delta customer card data.

    Why is it considered a third-party breach?

    Delta itself was not compromised. The chat vendor's software running on delta.com was.

    How did it happen?

    Attackers modified vendor chat JavaScript that had DOM access to Delta payment forms.

    What was exposed?

    Payment card and personal data submitted through delta.com during the exposure window.

    What was the impact?

    Hundreds of thousands notified, class actions and industry rethink of chat vendor risk.

    What controls could have reduced the risk?

    SRI, CSP, isolated card capture and hours-scale vendor notification.

    What should TPRM teams learn?

    Any script on the payment path is a payment vendor and must be governed as one.

    What is the biggest lesson?

    Customer support software can quietly become payment infrastructure.

    Public Sources Reviewed

    All claims in this case study are grounded in verified public reporting.

    Back to All Case StudiesExplore the Free TPRM Platform

    TPRM Blog

    Related TPRM analysis from the blog

    Continue learning with the latest breach alerts, regulatory updates, and analyst playbooks from blog.learntprm.com.

    Visit blog.learntprm.com
    Safe Security - founding sponsor of LearnTPRM.comFounding Sponsor
    For CISOs, TPRM leads and vendor risk program owners

    Autonomous TPRM. 90% less manual effort.

    Almost every case here was findable before it happened

    Read enough third-party breaches and the pattern is brutal: an undisclosed fourth party, an expired certification, an exposure that sat on the internet for weeks. Nobody was lazy - the signals simply arrive faster than a human review cycle. The SAFE TPRM AI Co-Worker watches for them continuously.

    This is for you if you own a third-party risk program - roughly 100+ vendors, quarterly reassessments, DORA / NIS2 / OCC pressure and no new headcount coming. The link opens Safe Security's platform page, not a gated form.

    Five correlated data dimensions per vendor, refreshed continuously across the whole portfolio.

    Zero-touch due diligenceContinuous monitoring across 5 dimensionsAI-powered risk scoring workflows
    • The Fourth-Party Discovery agent finds the undisclosed downstream provider before it becomes your incident.
    • The Outside-In agent detects new vulnerabilities, misconfigurations and breaches as they surface.
    • The Threat Intel agent tracks leaked credentials, filings and legal events per vendor.
    Evaluate SAFE for my organization

    For security and risk leaders assessing a TPRM platform. Opens safe.security in a new tab.

    25+

    AI agents

    90%

    Less manual effort

    None

    Additional headcount

    200+

    Organizations globally

    End to end

    Intake to offboarding

    Just here to learn? Read how Safe Security sponsors LearnTPRM

    Ready to Prove You're a TPRM Warrior?

    Most people talk about risk management. Few can prove their expertise under pressure.

    Start Your Free Certification