What’s next after airlines? Asia data breach raises wider cyber fears

A recent data breach affecting several airlines across Asia has raised concerns about the need for industries to reassess their reliance on third-party suppliers. Spanish software provider Amadeus experienced a security breach, which exposed customer information such as booking details, flight data, passenger names, and travel itineraries. Airlines like Cathay Pacific, Singapore Airlines, Malaysia Airlines, Japan Airlines, ANA, Qantas, and Asiana Airlines reported the breach, with varying degrees of impact.

Amadeus stated that it discovered a vulnerability in a travel booking display environment, but there was no evidence of payment or financial data being accessed. The company has implemented measures to fix the vulnerability, enhance monitoring and detection capabilities, and is in dialogue with customers and authorities.

Security experts warn that the breach's duration and concentration pose significant risks. Tony Ridley, a chief security and risk adviser, stated that a single provider's weakness can expose many airlines simultaneously, and the airlines learned of the breach from the vendor weeks after it became aware. The incident has also drawn comparisons to a SITA cyberattack in 2021, which targeted Passenger Service System servers.

Analysts suggest that the breach may have targeted specific individuals for sophisticated fraud, using exposed passport information for identity theft. Consumers who booked with affected airlines in the past three years are advised to be vigilant for unexpected messages, suspicious requests, and potential phishing attempts. Third-party risk analysts warn that the incident highlights the region's dependence on shared platforms and may soon extend to other critical sectors, including hospitality, financial services, healthcare, logistics, retail, ports, telecommunications, and government and educational institutions.