A cybersecurity incident involving Amadeus, the third-party reservation technology provider of Singapore Airlines, has resulted in the exposure of about 46,000 booking records. The breach has raised concerns regarding the issue of data security and risks related to third-party technology platforms in the aviation sector.
The airline announced the breach on November 3, stating that it was not its systems where unauthorized access took place, but those of Amadeus.
Passenger Information Compromised
According to Singapore Airlines, the compromised records included passenger names, booking reference numbers, travel itineraries, and booking classes.
Apart from that, approximately 620 records seem to have exposed additional information such as email addresses, phone numbers, travel documents details, and KrisFlyer numbers.
Nevertheless, Amadeus has confirmed that there was no theft of banking information and credit card data. The carrier declared that passenger reservations were not changed in the course of the breach.
Even though financial information was not compromised, the exposed travel information can be used in phishing schemes, fake bookings, and scams related to identity theft.
Amadeus Platform Security Flaw
The incident is linked to a vulnerability in the travel booking platform of Amadeus, a major tech firm providing support to airline reservation systems everywhere.
The vulnerability exposed booking data of customers to unauthorized access. However, the technical information about the vulnerability, including the method of how the hackers accessed the customers’ booking data, is under wraps.
Amadeus has taken action to contain the attacks and fix the loopholes to prevent any further access.
The Singapore Airline said that there were no breaches in its IT systems and assured that any exposure of data was only due to problems with its service provider.
Many international airlines suffered because of the same incident.
The security breach is not restricted to Singapore Airlines. There are quite a few international airlines which have revealed that they have been affected by the same Amadeus security defect.
The Cathay Pacific has reported that about 53,000 bookings were affected, while the Japan Airline has revealed the exposure of data of about 92,000 customers.
Other airlines like Malaysia Airlines and South Korea’s Asiana Airlines have experienced the same.
These incidents highlight the cybersecurity risks associated with shared third-party reservation infrastructure, where a single security weakness can affect multiple organizations.
Singapore Airlines’ Reaction to the Incident
Singapore Airlines has begun reaching out to all affected passengers with regard to their future travel arrangements by modifying their booking reference numbers.
The same airline has contacted the relevant authorities and expressed its apologies to those who were affected by the incident.
Security specialists advise passengers to be careful and alert to unexpected emails, phony flight-related updates, and dubious asks for personal details.
Large Interest in Third-Party Cybersecurity
The Amadeus incident manifests the need of managing third-party risks, conducting regular vulnerability checks, using strong type access controls, and monitoring the functioning of third-party vendors.
Airlines do not only need to ensure safety and security of the internal infrastructure but also the security of external systems used in running their business processes.
Taking into consideration the above incident, it should be noted that the risks of digital systems’ vulnerability may lead to exposure of sensitive information about the passengers in case the organization’s internal systems are secured.
