Key insights
- A user on WallStreetBets claims to have uncovered a significant security vulnerability in Alaska Airlines' loyalty program, alleging widespread account hacking and a failure to patch a known vulnerability. The user holds substantial put options on ALK. If the claims are credible and gain traction, it could negatively impact ALK's stock price due to reputational damage and potential regulatory scrutiny, though the actual impact is uncertain.
Ticker: $ALK
Positions (proof: https://imgur.com/sgHeFzw):
- 400x ALK Apr 17 2026 $32.50 Puts @ $0.59 Current $0.90 * 250x ALK Apr 17 2026 $37.50 Puts @ $1.09 Current $2.50 * 500x ALK Apr 17 2026 $40.00 Puts @ $1.45 Current $3.82 * 200x ALK Apr 17 2026 $45.00 Puts @ $2.63 Current $7.50
Total value at risk: ~$440k
Shouted about this before.
If you'd listened then you'd be well in the money. Nothing to do with Iran - trust me bro.
Since then I haven't sat still. I've found lots more mischief:
I Found Some Sellers
Six different ones. Deep in the Dark Web? only if that is what we are calling Facebook these days - just a basic search.
One of them claims selling 60 Alaska accounts a week.
They show off similar pricing: $120 for 220k miles. That is enough miles for 4 peeps on flats bed across the Atlantic.
I Followed the Money
Sellers offer up crypto wallets. Follow this one yourself:
0xA7964B5b406f439Dd527eAB89604e437E968D827
Goes all the way to 100s of millions heading into Binance.
An organised crime racket.
I Found The Reason for the PIN Lock
Victims get forced into using a verbal PIN after they have been hacked. Why?
Password changes don't do anything if a villain is in your account.
Try it yourself:
- Log into Alaska in two different browsers. 2. Change your password in one of them. 3. Refresh the page in the other. 4. Observe you are still fully logged in on browser 2.
You can keep that rogue session alive for a long time.
I Found Out Hackers Don't Need Passwords
Session cookies are wide open at they don't have HTMLOnly.
Obviously you don't know what that means, but any rogue chrome extension, or any rogue cookie in the system, means they skip the password bit and are in an account any time they like.
I Found Plenty More Junk
But this is enough to know the loyalty programme valued at $12 billion on a market cap of $4.5 billion is not locked down.
The Play
Probably go longer dated that I am. Puts FTW.
Positions (proof: https://imgur.com/sgHeFzw):
- 400x ALK Apr 17 2026 $32.50 Puts @ $0.59 Current $0.90 * 250x ALK Apr 17 2026 $37.50 Puts @ $1.09 Current $2.50 * 500x ALK Apr 17 2026 $40.00 Puts @ $1.45 Current $3.82 * 200x ALK Apr 17 2026 $45.00 Puts @ $2.63 Current $7.50
Total value at risk: ~$440k
ETA: Full analysis here.