The airline you book with may not be the only entity holding your personal data. A security breach at Spanish travel technology provider Amadeus has highlighted this, raising global concerns about passenger information security.
Several global airlines announced that their customers' data was affected by the incident, despite confirming their internal systems were not breached. This highlights the risks of relying on external technology companies to manage bookings and store passenger data.
Affected companies included Japan Airlines, which disclosed that the data of about 92,000 customers was impacted, and Hong Kong-based Cathay Pacific, which announced that around 53,000 bookings were affected, alongside Malaysia Airlines and others.
Malaysia Airlines confirmed the potential exposure of some customer information, noting there was no evidence that financial data was accessed. For its part, Amadeus stated that it discovered a security vulnerability in a technical environment used to display booking information, and investigations are ongoing to determine the scale of the breach.
Traveler data does not stay with airlines alone
When booking a flight, the storage of personal information is not limited to the airline's systems. The travel industry relies on a vast network of technology service providers that manage bookings, issue tickets, and handle check-in procedures, connecting airlines with travel agencies and airports.
Flight data is typically stored in a record known as a PNR (Passenger Name Record), which includes information such as the passenger's name, booking number, flight dates, and contact details.
In some cases, this record may contain more sensitive information, including passport numbers, nationalities, and frequent flyer data, making external company systems a crucial part of the passenger data protection ecosystem.
Consequently, a breach of a technology service provider can put customer information at risk, even if the airline successfully secures its own network and internal systems.
How can booking data be exploited in fraud?
Fraudsters do not necessarily need bank card data to harm travelers. Simply knowing a customer's name, booking number, and flight date can provide enough information to execute highly convincing scams.
Hackers may use these details to send fake messages that appear to be from the airline, asking the traveler to confirm their booking, pay additional fees, or update passport information.
These messages become increasingly dangerous when they include accurate information about a real flight, making the fraud much harder to detect.
In the Amadeus incident, Japan Airlines revealed that the data of about 2,000 customers included additional information, such as passport numbers and contact details. However, the affected companies confirmed there is no evidence of payment data leaks, nor has it been proven so far that the compromised information was used in fraudulent activities.
Who is responsible for protecting traveler data?
The responsibility for protecting information is shared between airlines and technology service providers. Airlines must choose reliable partners and monitor how they handle customer data, while technology companies are responsible for securing their systems and restricting access to information.
Determining legal liability and potential compensation depends on the nature of the breach, applicable laws, and the contracts governing the relationship between the parties.
Given these risks, travelers are advised not to interact with unexpected messages regarding booking changes or requests for additional fees. They should avoid unknown links and verify any request for personal data through the airline's official website or app.
