More news on this day
U.S. authorities and SkyWest Airlines have accused two former pilots of exploiting the carrier’s internal systems to harvest the personal details of nearly 5,000 employees, in a case that blends cybersecurity threats with an increasingly bitter labor dispute in the regional aviation sector.
Alleged Breach of SkyWest’s Internal Directory
According to a civil complaint filed in late January in the U.S. District Court for the District of Utah, SkyWest alleges that former pilots Daniel Moussaron and Vikaas Krithivas systematically accessed confidential fields inside SkyWest Online, the company’s internal portal, over several months in 2025. Investigators say log data show repeated sessions in which the men moved through the pilot seniority list, pulling records well beyond the limited contact information visible to rank-and-file employees.
SkyWest contends that the pair bypassed role-based protections intended to shield home addresses, personal cellphone numbers and other sensitive details from general view. The airline says nearly 5,000 pilot records were ultimately exposed, affecting a workforce that flies regional routes on behalf of major U.S. carriers including American Airlines, Delta Air Lines, United Airlines and Alaska Airlines.
The U.S. government has backed the airline’s allegations by referencing potential violations of the Computer Fraud and Abuse Act, a key federal statute used in cases of unauthorized access to protected systems. While no criminal charges have been publicly announced, the framing of the case as an intentional intrusion by insiders has drawn the attention of regulators focused on cyber risks in transportation.
Lawyers for the former pilots dispute the characterization of their conduct as hacking, arguing in court filings that the information was available through standard browser tools and that no passwords were cracked, permissions altered or server-side defenses broken.
Inside the Timeline: From First Access to Mass Messaging
Court documents outline a detailed chronology that begins on August 29, 2025, when SkyWest says Moussaron initiated what it calls a test run inside the SkyWest Online directory during an overnight layover. Initial activity appears modest, with a handful of records accessed and downloaded, but subsequent sessions reportedly grew in scope and regularity as he moved methodically down the seniority list.
By early September, the complaint alleges, Krithivas had joined the effort. On at least one day in that period, SkyWest’s logs purportedly show a massive spike in directory activity as nearly the entire pilot roster, roughly 4,970 names, was scraped in a single, hours-long session. The airline claims the activity pattern shifted from slower, manual lookups to what appeared to be automated data extraction tools working through the directory in sequence.
Problems surfaced internally in December 2025, when pilots began reporting a wave of unsolicited calls and text messages to their personal phones. One pilot told management that a caller promoting an “outside effort” boasted of having “really smart people” who had discovered a backdoor into the company directory, language that SkyWest later cited as evidence that the contact details were not gathered through ordinary workplace channels.
SkyWest says the ensuing internal investigation confirmed that confidential fields in the directory had been queried far beyond normal use patterns. Forensic analysts hired by the airline concluded that system protections had effectively been circumvented, even if no traditional hacking tools were used, and recommended tightening access to nonpublic employee data.
Union Organizing at the Heart of the Dispute
At the center of the legal and political fight is an organizing campaign to bring SkyWest’s pilots under the umbrella of the Air Line Pilots Association, one of the largest pilot unions in North America. In sworn statements, Moussaron has said his primary goal was to contact fellow pilots about unionization and that he viewed the internal directory as the most reliable way to reach colleagues scattered across bases and partner airlines.
He and Krithivas maintain that they used only tools built into modern web browsers to reveal data that SkyWest had chosen to embed on the page but not display to standard users. In that view, the company’s failure to fully restrict access, not any deliberate circumvention, is to blame for the exposure. Their attorneys have asked the court to treat the dispute as a matter of labor law, arguing that any outreach conducted to advance union organizing should fall under protections for concerted activity.
SkyWest sharply rejects that framing, insisting that whatever the motive, the pilots had signed confidentiality and non-disclosure agreements that barred using internal systems to harvest personal data for nonbusiness purposes. The airline says the men coordinated their efforts, handing off the seniority list between themselves, and that they continued to return to the system even after the bulk extraction was complete in order to capture contact details for newly hired pilots.
The case has quickly become a flashpoint for organized labor across the U.S. aviation industry. Unions argue that carriers routinely control official communication channels and that employees increasingly resort to digital workarounds to connect with each other, while airlines warn that such tactics can cross legal lines when they involve personal data and secured systems.
Privacy, Cybersecurity and Regulatory Scrutiny
Beyond the labor battle, the allegations have stirred broader concerns about how regional airlines secure employee data. SkyWest has told the court that the incident forced it to divert substantial resources from operations and IT projects to investigate the breach, notify affected pilots and harden its systems. The carrier has emphasized that there is no indication that critical flight operations or passenger reservation systems were touched, stressing that the exposure appears confined to the administrative directory.
Cybersecurity specialists say the case highlights the particular risk posed by insiders with legitimate credentials but expansive technical knowledge. In sectors like aviation, where employees are widely dispersed and rely heavily on online portals for scheduling and internal communications, role-based access controls and data minimization are seen as essential safeguards against precisely the type of scraping described in the lawsuit.
Federal transportation and labor officials are watching closely as they refine guidance on data security and worker privacy. Industry analysts note that, in recent years, the Federal Aviation Administration and other agencies have urged carriers to adopt stronger authentication, more detailed logging and stricter segmentation of internal systems, in part to reduce the impact of insider misuse.
For employees, the case raises uncomfortable questions about how much personal information should be stored in corporate systems at all, and what recourse individual workers have when their contact details, addresses and other sensitive data are used in ways they never anticipated upon hiring.
Legal Paths Ahead for SkyWest and the Former Pilots
SkyWest is seeking monetary damages, a jury trial and court orders that would require the former pilots to turn over electronic devices for forensic review. The company argues that such measures are necessary to determine how widely the data may have been shared beyond the initial organizing effort and whether copies remain on personal hardware or cloud services not under corporate control.
Moussaron has moved to dismiss the complaint on jurisdictional grounds, characterizing the dispute as a labor matter that should be handled through federal labor channels rather than as a stand-alone computer fraud case. Krithivas, in his own filings, has similarly framed his role as limited to assisting a union drive that he believed was lawful, while denying any intent to profit from or further disseminate the data beyond organizing communications.
Legal experts expect an initial round of rulings on those jurisdictional and procedural questions before any full trial on the merits. A decision on whether the pilots’ conduct qualifies as unauthorized access under federal law, or instead as protected union activity complicated by weak internal security, could set an important precedent for how U.S. courts treat data scraping by employees in the digital workplace.
For now, tens of thousands of aviation workers across the United States are watching the Utah case as a bellwether. It may help define not only how far employees can go in using company systems to organize across bases and hubs, but also how aggressively airlines and regulators must act to guard personal data in an era where a single insider can quietly reach thousands of coworkers with a few keystrokes.