Six Asian airlines have disclosed data breaches over the past week that trace back to Amadeus IT Group, the Spanish company that builds and maintains flight reservation, ticketing and check-in platforms.
Airlines Affected
Japan Airlines, Cathay Pacific, Korean Air, Asiana Airlines, Singapore Airlines and Malaysia Airlines have all come forward.
| Airline | Reported impact |
|---|---|
| Japan Airlines | About 92,000 customers (warning issued October 28) |
| Cathay Pacific | 53,000 records: booking numbers, passenger names, flight details; some include passports or other travel documents, frequent flyer numbers and email addresses |
| Singapore Airlines | 46,000 records: confirmation numbers, itineraries, names |
| Korean Air, Asiana | Reported by Chosun on October 23 |
| Malaysia Airlines | Statement reported around November 1 |
What Amadeus Says
Amadeus said it recently became aware of a vulnerability affecting a travel booking display environment. Cathay Pacific said Amadeus told it the attackers used "login credentials assigned to its system account."
Amadeus says no payment or financial data was accessed, has fixed the vulnerability, added monitoring and detection, and is in contact with customers and authorities. It also says there are no signs the vulnerability was exploited for ransomware. It has not said whether the attackers have contacted it or how many victims there are.
All of the airlines say their own systems and operations were not affected. Singapore Airlines is contacting passengers with upcoming flights so they can change their exposed booking numbers, and has warned customers about malicious emails.
Recommendations
- Travelers should be wary of emails or messages that reference their bookings, and verify through the airline's official channels.
- Passengers whose passport details may be involved should monitor for identity misuse.
- Organizations should review third-party access, especially service accounts used by vendors, and enforce MFA and monitoring on them.