CNA Explains: Your flight booking details have been leaked. What can hackers do with them?

Singapore Airlines recently experienced a data breach involving its software provider Amadeus, resulting in the exposure of approximately 46,000 passenger records. The leaked information included passengers' names, booking references, travel itineraries, and in some cases, additional details such as email addresses, phone numbers, travel document information, and KrisFlyer membership numbers.

While cybercriminals may not have access to passwords or credit card details, they could still exploit this data to carry out various forms of fraud and scams.

Cybersecurity experts warn that stolen booking information could be used to impersonate airlines or travel agencies, sending convincing scam messages to passengers. These messages could trick individuals into clicking fraudulent links, potentially revealing sensitive passwords or credit card information. Additionally, criminals could attempt to gain unauthorized access to passengers' flight reservations or frequent-flyer accounts.

Depending on an airline's security measures, someone with a booking reference and surname might be able to retrieve or attempt to modify a reservation.

Other potential risks include account takeover attempts and identity fraud, particularly if email addresses, phone numbers, or travel document details were also exposed. Stolen booking information could also be sold to other cybercriminals for future attacks, as these datasets can be combined with information from other breaches to create more convincing profiles of individuals.

While the exposed information may not directly grant criminals access to bank accounts, credit cards, or frequent-flyer accounts, the risk lies in the trust passengers may place in seemingly legitimate communications from airlines or travel agencies. Dr. Bernard Tan, a consultant from Protiviti Singapore, notes that while booking information alone may not grant direct access to financial accounts, the familiarity of travel details could make passengers more susceptible to trusting a potential scam.

In previous cases involving airlines, exposed booking details have allowed fraudsters to alter reservations or cancel flights without the passengers' knowledge. For example, in 2018, Cebu Pacific's online booking system exposed passenger data, resulting in 678 bookings being changed and 332 of those changes attributed to anonymous users.

In January 2024, an IndiGo passenger reported that eight tickets were cancelled without his permission, with the cancellation likely resulting from a fraudster using his booking reference to modify the reservation's contact details and cancel the tickets.