Security researchers who first revealed the data breach told TechCrunch that they gained access to the carrier's systems by brute-forcing the system's easily guessable password.
In a statement, SpiceJet said: "At SpiceJet, safety and security of our fliers' data is sacrosanct. Our systems are fully capable and always up to date to secure the fliers' data which is a continuous process. We undertake every possible measure to safeguard and protect this data and ensure that the privacy is maintained at the highest and safest level".
The private information of more than 1.2 million passengers were contained on an unencrypted database backup file of SpiceJet's systems, according to the report.
The details that the security researchers got access to as part of what they described as their "ethical hacking" efforts included the passenger's name, their phone number, email address and their date of birth.
Acording to the security researchers, the database was easily accessible to everyone who knew where to look.
Despite alerting SpiceJet about the data base, the researchers said they did not receive a meaningful response from the carrier.
This led them to alert the Indian Computer Emergency Response Team (CERT-In).
The aviation major, however, did not confirm CERT-In's findings.
( With inputs from IANS )