Passenger hacks IndiGo website to find lost luggage

An IndiGo passenger, whose luggage got exchanged with another passenger while travelling from Patna to Bengaluru, took the matters in his own hands after the airline’s customer care failed to resolve the issue on time.

Nandan Kumar, a software engineer, took to Twitter to share how he used his developer instincts to find his lost luggage.

This happened after the airline refused to provide him the contact details of the co-passenger who had mistakenly taken his luggage citing data privacy.

In a viral Twitter thread, Kumar said his baggage got exchanged with another passenger as both the bags were exactly the same with some minor differences. "I realised it only after I reached home when my wife pointed out that the bag seems to be different from ours as we don’t use key based locks in our bags," he wrote.

After reaching home, Kumar called IndiGo's customer care. "After multiple calls and navigating through @IndiGo6E IVR and of course a lot of wait I was able to connect to one of your customer care agents and they tried to connect me with the co-passenger. But all in vain," he said.

Kumar said IndiGo's customer care team was not ready to provide him the contact details of the person citing privacy and data protection.

He then started digging into the IndiGo website trying the co passenger’s PNR which was written on the bag tag in hope to get the address or number by trying different methods like check-in, edit booking, update contact, but to no avail whatsoever.

"After all the failed attempts, my dev instinct kicked in and I pressed the F12 button on my computer keyboard and opened the developer console on the @IndiGo6E website and started the whole checkin flow with network log record on," Kumar said.

"And there in one of the network responses was the phone number and email ID of my co-passenger. Ah this was my low-key hacker moment and the ray of hope. I made note of the details and decided to call the person and try to get the bags swapped," he added.

Kumar was able to reach his co-passenger with the phone number he got from the logs and luckily they lived in a close proximity of 6-7 kilometres. The decided to meet at a centre point to get their bags swapped.

Responding to Kumar's Twitter thread, IndiGo issued a statement saying that the airline remains fully committed to customer data privacy and industry benchmark cybersecurity standards. "We'd like to inform you that we've a dedicated option available for mishandled baggage and other options for assistance on IVR…We tracked back and found that you selected 'flight info' and 'flight cancellation' instead of mishandled baggage as per your query option on IVR which took time connection out customer care team."

IndiGo said it is now allowed to share any of the passenger's information due to data privacy policy. "Our customer care team tried to arrange a conference call in order to facilitate the exchange of baggage. We'd also like to state that our IT processes are completely robust and, at no point was the IndiGo website compromised. Any passenger can retrieve their booking details using PNR, last name, contact number, or email address from the website," it said.