Singapore Airlines says 46,000 booking records were affected by a breach at Amadeus, a travel technology provider used to manage reservations and passenger information. The airline said its own IT systems were not breached.
The exposed records included customers’ names, booking reference numbers, itineraries and booking classes. In around 620 cases, the information also included email addresses, phone numbers, travel document details or KrisFlyer membership numbers.
According to Reuters, Singapore Airlines is contacting affected customers with upcoming trips and changing their booking reference numbers as a precaution.
Amadeus said a vulnerability in a travel booking display environment had made certain booking data accessible to attackers. The company said it found no evidence that payment or other financial data had been accessed, and reported that it had fixed the vulnerability and strengthened monitoring and detection.
Singapore Airlines is among several carriers reporting exposure linked to the Amadeus incident. Cathay Pacific, Japan Airlines, Japan Transocean Air, All Nippon Airways, Korean Air, Asiana Airlines and Malaysia Airlines have also confirmed they were affected. Qantas said it was investigating.
The exposed booking and travel details could help criminals create convincing phishing messages that refer to real trips or passenger information. The source report said there was no indication that the stolen data had appeared on the dark web and no threat actor had claimed responsibility.
Sources: TechRadar.