CNA Explains: Your flight booking details have been leaked. What can hackers do with them? - CNA
Singapore Airlines (SIA) confirmed that approximately 46,000 booking records were accessed in a data breach involving its software provider Amadeus, exposing passengers' names, booking references, and travel itineraries.
The exposed information includes passengers' names, booking references, and travel itineraries, with some records potentially containing additional details such as email addresses, phone numbers, travel document information, and KrisFlyer membership numbers. According to Amadeus' website, airline booking records may also include cabin classes, departure and arrival airports, and supplementary services like hotel stays or rental cars booked through travel agents.
Scam Risks
Cybersecurity experts warn that the primary danger is criminals using this information to execute convincing scams. Scammers could impersonate airlines or travel agencies, sending messages about flight cancellations or rescheduling with accurate passenger details to trick victims into revealing passwords or credit card information.
The near-term risk is the high chance of scams by email, SMS or phone that mention a real booking - affected users may be tricked into handing over credentials or card details.
Unauthorized Access
Beyond phishing, criminals might attempt to access passengers' flight reservations or frequent-flyer accounts. Depending on an airline's security protocols, someone with a booking reference and surname could potentially retrieve, change, or cancel a reservation. Kaspersky's Adrian Hia noted that exposed contact details could lead to account takeover attempts and identity fraud.
Stolen information could also be sold to other cybercriminals and combined with data from other breaches to create more comprehensive profiles for future attacks. Assoc Prof Zhang warned that compromised personal information might be misused months or even years after the breach.
Previous Incidents
Similar cases have occurred before. In 2018, Cebu Pacific's system update allowed passengers to view others' booking details, resulting in 678 booking changes, though the airline reported no confirmed fraud. In 2024, an IndiGo passenger discovered eight tickets had been cancelled after his booking reference became publicly visible.
Dr Tan emphasized that these cases demonstrate how exposed booking details can be exploited. "These cases show what can happen when booking details are exposed," he said.
Protective Measures
Although Amadeus confirmed no bookings were changed, SIA contacted affected customers with upcoming travel plans to provide new booking reference numbers as a precaution. Assoc Prof Zhang explained that new reference numbers prevent unauthorized access through the old ones, provided the airline invalidates them.
Experts advise passengers to be wary of unexpected messages about flight changes, cancellations, or refunds. Dr Tan stressed that accurate booking details don't guarantee message authenticity and recommended verifying requests through official airline channels. Passengers should also monitor their reservations and accounts for unauthorized activity.
For passengers whose passport information was exposed, Mr Hia suggested remaining alert for identity-related fraud and monitoring frequent-flyer accounts. However, Dr Tan noted that drastic measures like replacing passports aren't necessary unless specific misuse is confirmed.
Airlines' Responsibility
Experts urge airlines to promptly notify affected customers and implement preventive measures including reissuing booking references, monitoring suspicious activity, and strengthening verification procedures. Assoc Prof Zhang recommended limiting how much access a booking reference provides.
Mr Hia emphasized the need for stronger safeguards against phishing campaigns and additional verification for sensitive booking changes. He highlighted how breaches at external providers can affect even airlines with strong cybersecurity, calling for strengthened oversight of third-party vendors to ensure they meet comparable security standards.
Related
