Former employee admits hacking attacks against PenAir
A woman who spent nearly three decades working for a southwest Alaska regional airline admitted in federal court Friday that she was behind a series of hacking attacks on the company’s reservation systems last spring.
Suzette Kugler pleaded guilty to one count of committing fraud in connection with computers, during offenses against PenAir in April and May of 2017. The government dropped a second count of the same offense as part of the agreement.
In a nearly deserted Anchorage courtroom, Kugler quietly answered questions from U.S. District Judge Sharon Gleason, confirming that she would become a convicted felon and forfeit her right to any appeals.
Kugler’s LinkedIn page says she worked at PenAir for 29 years until February, rising to become the company’s director of system support – a position which made her responsible for "oversight, policy, procedure and development as it relates to software for customer service and flight tracking."
According to Dillingham public radio station KDLG, PenAir had previously blamed its $27 million purchase of Saab 2000 turboprops in 2015 for a series of flight cancellations due to mechanical issues. The company filed for Chapter 11 bankruptcy last year, shuttering most of its operations outside Alaska.
PenAir officials didn’t respond to requests for comment on the case Friday afternoon.
A summary of Kugler’s plea agreement said the airline contacted FBI agents in May, regarding a series of “recent computer intrusions” targeting its Sabre computer software for flight bookings and reservations. Investigators found that Kugler had deleted another employee’s access credentials to Sabre on April 5, and entered the system again on May 2 to delete eight airports’ station information.
“Station information is the airport specific portal for PenAir employees to access Sabre,” prosecutors wrote. “This deletion prevented employees in any of those eight airports from being able to book, ticket, modify, or board any flight until the stations were rebuilt in the system.”
The following day, Kugler deleted two of PenAir’s three seat-map templates for aircraft flown by the company.
“Without seat maps, PenAir cannot board or ticket any passengers for any flight,” prosecutors wrote.
Other airline personnel were able to restore the deleted items in overnight work before the next day’s flights, at a cost PenAir estimated between $5,000 and $6,500.
A July search of Kugler’s Desert Hot Springs, Calif. home turned up two laptop computers with transmission logs for the malicious commands matching those recorded by Sabre.
Adam Alexander, the assistant U.S. attorney who prosecuted Kugler, read the plea agreement's summary of the case in court Friday. Gleason then asked Kugler if she admitted to committing the crimes he described.
“Yes,” Kugler said, her voice calm.
Kugler also agreed to forfeit the laptops seized from her home.
Neither side discussed Kugler’s motive for the attacks at Friday's hearing. Alexander later said that he wasn’t able to discuss the case beyond the documents filed in it to date.
Gleason set an April 11 sentencing date for Kugler, who faces a maximum sentence of 10 years in prison, three years on supervised release and a $250,000 fine.
Bryan Dunagan and Janis Harper contributed information to this story.
Copyright 2018 KTVA. All rights reserved.