Amadeus incident exposes booking data at Singapore Airlines, Cathay Pacific, Japan Airlines and other Asian

What happened

Japan Airlines, Cathay Pacific, Korean Air, Asiana Airlines, Singapore Airlines and Malaysia Airlines have each reported data breaches traced back to Amadeus IT Group, a provider of flight reservation, ticketing and check-in platforms The Record.

Amadeus told Recorded Future News that it became aware of a vulnerability affecting a travel booking display environment. It said certain booking-display data was accessible through the vulnerability and that there is no evidence payment or financial data was accessed. It also said there are no indications the vulnerability has been exploited for ransomware purposes, that it implemented measures to fix the vulnerability and enhanced monitoring and detection, and that investigations continue The Record. Amadeus did not say how many customers were affected Economic Times.

Figures reported so far:

• Singapore Airlines said about 46,000 booking records may have been affected. Exposed data included names, booking reference numbers, travel itineraries and booking classes. For about 620 of those records, email addresses, phone numbers, travel document details and KrisFlyer membership numbers may also have been accessed ETCISO.
• Cathay Pacific reported data involving 53,000 bookings, and Japan Airlines reported 92,000 customers Economic Times. The Record describes the Cathay data as 53,000 records, including booking numbers, passenger names and flight details, with some records including passports, other travel documents, frequent flyer numbers and email addresses The Record.
• Malaysia Airlines said some of its customer information may have been affected, with no count given in the sources ETCISO.

The exact technical cause is not confirmed. Amadeus describes a vulnerability, while Cathay Pacific said Amadeus told it that the threat actors used login credentials assigned to its system account, without further explanation The Record. Attribution to a specific threat actor is not confirmed, and Amadeus declined to say whether the attackers contacted it.

All the airlines said the incident did not affect their own systems or operations The Record. Singapore Airlines said Amadeus confirmed that bank account or credit card information was not leaked and that bookings were not modified ETCISO.

Am I affected?

You may be affected if you booked travel with Japan Airlines, Cathay Pacific, Korean Air, Asiana Airlines, Singapore Airlines or Malaysia Airlines, since all have reported incidents traced to Amadeus. The sources also say “and others” have reported compromised data, so the full list of airlines is not confirmed Economic Times.

Singapore Airlines says it is contacting affected customers who have upcoming travel plans ETCISO. If you have not been contacted, check your airline’s own notice. The sources do not describe a way to check individual exposure.

Security and travel teams at organizations that rely on Amadeus platforms should treat this as a third-party incident. Which Amadeus products or customers beyond these airlines are in scope is not confirmed.

What to do now

1. Check your airline’s breach notice or email. If you have an upcoming trip, change your booking reference number as Singapore Airlines is asking affected customers to do.
2. Be wary of malicious emails. Singapore Airlines urged customers to be careful, and exposed names, itineraries and booking numbers could make phishing look convincing The Record.
3. If your travel documents or frequent flyer number were among the exposed fields, watch the related accounts. Some airlines said passports, other travel documents and membership numbers were in a subset of records.
4. If you are a business customer of Amadeus, ask your account contact for incident details, including whether system account credentials were involved, since the cause is not confirmed.
5. As a precaution, review and rotate credentials for any vendor system accounts you operate, and monitor for further disclosures from Amadeus and the airlines, as investigations continue.

Sources

• ETCISO: Singapore Airlines reports 46,000 booking records compromised by Amadeus incident
• The Economic Times: Singapore Airlines says 46,000 booking records affected by Amadeus breach
• The Record: More Asian airlines announce data breaches after attack on Spanish IT provider Amadeus