A major cybersecurity incident has raised concerns over passenger data protection in the global aviation industry after Singapore Airlines confirmed that information linked to nearly 46,000 bookings had been accessed without authorisation. The breach has been linked to a security vulnerability in the booking technology platform operated by Spanish technology company Amadeus.
According to the airline, the exposed information includes passengers' names, booking reference numbers, travel itineraries and ticket class details. In around 620 bookings, more sensitive information may also have been accessed, including email addresses, phone numbers, travel document details and KrisFlyer membership numbers.
However, Singapore Airlines has clarified that customers' bank account details and credit card information were not compromised. The airline also stated that no changes were made to existing flight bookings and that its own IT systems were not directly affected. The incident was reportedly limited to the Amadeus platform, which provides reservation and booking technology to several international airlines.
How Did the Data Breach Happen?
Airlines across the world depend on third-party technology providers to manage ticket reservations, passenger information and travel-related services. Singapore Airlines also uses parts of Amadeus's technology infrastructure for its booking operations.
The security breach reportedly occurred after an unauthorised third party exploited a vulnerability in the platform's booking display system. Amadeus has acknowledged the security issue and said that necessary measures have been taken to address the vulnerability and strengthen its security systems. However, the company has not disclosed a complete breakdown of the number of affected customers.
Singapore Airlines has started contacting passengers whose booking information may have been compromised. Customers with upcoming journeys are also being provided with updated booking reference numbers as a precautionary measure. The airline has informed the relevant authorities and apologised to affected customers.
Several International Airlines Also Affected
The incident has raised wider concerns because several other international airlines have reportedly faced similar data exposure linked to the same technology vulnerability.
Cathay Pacific reported that information connected to approximately 53,000 bookings was affected. Japan Airlines reported unauthorised access involving around 92,000 customers, while All Nippon Airways (ANA) reported that nearly 37,800 passengers were affected.
Malaysia Airlines, Korean Air and Asiana Airlines have also been linked to the incident.
Why Are Passengers at Risk?
Although financial information was reportedly not exposed, cybersecurity experts warn that personal travel details can still be misused. Criminals could use booking references, travel dates, destinations and contact information to create convincing phishing messages.
For instance, passengers could receive fake notifications claiming that their flights have been cancelled or that additional payments are required. Fraudsters may also impersonate airline representatives and attempt to obtain passwords, one-time passwords or sensitive identity documents.
The incident highlights the growing cybersecurity challenges facing the aviation industry, where vast amounts of passenger information are stored and processed through interconnected digital platforms. Even a vulnerability in a third-party service provider can potentially expose the personal information of thousands of travellers across different countries.
Reader Comments 0