CNA Explains: Your flight booking details have been leaked. What can hackers do with them?
Exposed airline booking details could be used to carry out convincing scams and other forms of fraud, cybersecurity experts say. Here's what passengers should know and how they can protect themselves.
Singapore Airlines (SIA) experienced a data breach involving its software provider, Amadeus, which exposed 46,000 booking records containing passengers' names, booking references, travel itineraries, and in some cases, contact details and KrisFlyer membership numbers. Cybersecurity experts warn that these exposed details could be used for scams and other forms of fraud.
Impersonation scams are the most significant risk, as cybercriminals could use a passenger's name, booking reference, and travel itinerary to send emails or messages claiming their flight has been cancelled or rescheduled. This could trick passengers into clicking fraudulent links, disclosing passwords or credit card details. The near-term risk is high, with experts warning that affected users may be targeted with phishing scams via email, SMS, or phone calls.
In addition to scams, criminals might attempt to gain unauthorized access to passengers' flight reservations or frequent-flyer accounts. An airline's security checks determine the likelihood of this occurring, but if successful, a scammer could retrieve a reservation, change or cancel a flight using the booking reference and surname.
Exposing booking details could also lead to account takeover attempts and identity fraud, particularly if email addresses, phone numbers, or travel document details were also exposed. Stolen information could be sold to other cybercriminals for future attacks, making subsequent attempts more convincing and effective as the attacker builds a more complete profile of the individual.
Although the Amadeus breach has not yet led to confirmed fraud, several incidents involving airlines illustrate the potential risks. For instance, Cebu Pacific's online booking system in 2018 allowed passengers to view other customers' booking details, resulting in 678 changes and 332 of those being made by anonymous users. Similarly, an IndiGo passenger in India had eight tickets cancelled without his permission, suspected to be caused by a fraudster using a public booking reference.
Written by urgent.news from Channel News Asia's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
