CNA Explains: Your flight booking details have been leaked. What can hackers do with them?

Exposed airline booking details could be used to carry out convincing scams and other forms of fraud, cybersecurity experts say. Here's what passengers should know and how they can protect themselves.

New: You can now listen to articles.

This audio is generated by an AI tool.

11 Nov 2026 12:01PM

SINGAPORE: Around 46,000 Singapore Airlines (SIA) booking records were recently accessed in a data breach involving its software provider Amadeus.

The exposed information included passengers' names, booking references and travel itineraries, while some records may also have contained contact details and KrisFlyer membership numbers.

But what can cybercriminals do with such information, even without access to passwords or credit card details?

CNA asked cybersecurity experts about how stolen airline booking records could be misused, whether similar incidents have occurred before and what affected passengers can do to protect themselves.

What do airline booking records contain?

According to a media statement by SIA on Tuesday (Nov 3), the data accessed during the breach included passengers' names, booking reference numbers, travel itineraries and booking classes.

For around 620 of the affected records, additional information such as email addresses, phone numbers, travel document details and KrisFlyer membership numbers may also have been accessed.

Airline booking records can contain a range of other information, depending on how a trip was arranged.

According to Amadeus' website, such records may include cabin classes, departure and arrival airports, as well as supplementary services booked through travel agents, such as hotel stays, airport transfers and rental cars.

How can hackers misuse your data?

The biggest risk is that criminals could use stolen booking information to carry out convincing scams, cybersecurity experts told CNA.

With access to a passenger's name, booking reference and travel itinerary, scammers could send emails or messages impersonating an airline or travel agency.

For instance, a passenger could receive a message claiming that their flight has been cancelled or rescheduled, complete with their actual destination and travel dates.

Such messages could trick passengers into clicking fraudulent links, revealing passwords or handing over credit card details.

“The near-term risk is the high chance of scams by email, SMS or phone that mention a real booking - affected users may be tricked into handing over credentials or card details,” said Associate Professor Zhang Tianwei of Nanyang Technological University’s College of Computing and Data Science.

Dr Bernard Tan, a consultant from Protiviti Singapore, noted that while booking information alone may not give criminals access to bank accounts, credit cards or frequent-flyer accounts, “the risk is that familiar travel details could lead passengers to trust a scam they might otherwise question”.

Beyond phishing scams, criminals could also attempt to gain unauthorised access to passengers' flight reservations or frequent-flyer accounts.

Depending on an airline's security checks, someone with a passenger's booking reference and surname might be able to retrieve a reservation or attempt to change or cancel a flight, Dr Tan said.

Kaspersky’s managing director for Asia Pacific Adrian Hia said other possible risks include account takeover attempts and identity fraud, particularly if email addresses, phone numbers or travel document details were also exposed.

Travel itineraries could also reveal when individuals are away from home or attending specific events, potentially posing privacy or physical security risks, Mr Hia added.

Stolen booking information could also be sold to other cybercriminals and used in future attacks.

“Rather than being exploited immediately, compromised personal information is often aggregated into large datasets and sold to other threat actors, sometimes at surprisingly low prices," Mr Hia said.

“These datasets can then be combined with information from other breaches to build more complete profiles of individuals, making subsequent attack attempts significantly more convincing and effective.”

Assoc Prof Zhang similarly warned that stolen information could be misused months or even years after a breach.

Has this happened before?

Several incidents involving airlines have illustrated how exposed booking details can create opportunities for unauthorised access or changes, although data exposure has not always led to confirmed fraud.

On May 18, 2018, an update to Cebu Pacific's online booking system resulted in passengers being able to view other customers' booking details, including names, booking references, flight dates and destinations.

According to the Philippine National Privacy Commission, 678 bookings were changed while the affected system was operating. 

Cebu Pacific subsequently determined that 332 changes had been made by anonymous users, while the remaining 346 were system updates.

The airline said it received no confirmed complaints of fraudulent booking modifications during its investigation. The regulator closed the case in February 2023 after considering the measures the airline had put in place.

In January 2024, an IndiGo passenger in India reported that eight tickets booked for himself and his family had been cancelled without his permission. 

The passenger had earlier contacted the airline on social media over an online check-in issue.

IndiGo said his booking reference had been publicly visible and believed a fraudster had used it to change the reservation's contact details before cancelling the tickets.

The passenger discovered the cancellation shortly before his flight, and the airline subsequently offered to waive the cancellation charges.

While neither case arose from the Amadeus breach, they illustrate how exposed booking information could potentially be exploited.

"These cases show what can happen when booking details are exposed," said Dr Tan.

You received a new booking reference number. Is the problem solved?

Not entirely, experts said.

Although Amadeus confirmed that no bookings were changed as a result of the breach, SIA contacted affected customers with upcoming travel plans to change their booking reference numbers as a precaution.

A booking reference is a unique identifier used to retrieve a flight reservation. Depending on an airline's security checks, it may also be used alongside other information to access or manage a booking.

Replacing an exposed reference number can prevent unauthorised access through the old one, provided the airline invalidates it.

“The new reference numbers stop the old ones from being used to look up, change, cancel or check in to the booking, and from being used to impersonate the passenger with the airline,” said Assoc Prof Zhang.

However, the level of protection also depends on what additional checks an airline requires before allowing someone to access or modify a reservation, said Dr Tan.

More importantly, changing a booking reference cannot undo the exposure of other personal information.

“Scammers who know a passenger’s name, destination and travel dates could still use them in messages impersonating the airline," Dr Tan said.

“A new reference helps secure the booking; it does not take back personal information already in someone else’s hands.”

What should affected passengers do?

Passengers should be especially wary of unexpected messages or calls about flight changes, cancellations, refunds or requests for additional payments, said Assoc Prof Zhang.

This applies even when such communications contain accurate booking details.

“Accurate booking details are not proof that a message is genuine,” said Dr Tan.

He advised passengers to verify unexpected requests directly through an airline's official website, mobile application or customer service hotline, rather than clicking links in messages.

Passengers should also check upcoming reservations for unauthorised changes and ensure their email and frequent-flyer accounts are secure.

Mr Hia advised passengers whose passport or travel document information has been exposed to remain alert for identity-related fraud and suspicious account openings.

They should also monitor their frequent-flyer accounts for unusual activity, he added.

However, drastic measures may not be necessary in every case.

“Passengers do not need to replace passports or cancel credit cards immediately unless there is specific evidence of misuse or advice to do so from the relevant authorities or service providers,” said Dr Tan.

What should airlines do to protect passengers?

Airlines should promptly notify affected customers about what information was exposed and take steps to prevent stolen booking details from being misused, experts said.

These measures include reissuing exposed booking references where appropriate, monitoring suspicious activity and strengthening verification procedures before allowing changes to reservations.

Assoc Prof Zhang said airlines should also limit how much access a booking reference alone provides.

Mr Hia called for stronger safeguards against phishing campaigns that exploit stolen travel information, as well as additional verification for sensitive booking changes.

Beyond securing their own systems, airlines must also pay closer attention to the cybersecurity practices of external technology providers, he said.

“This incident highlights how a compromise at an external technology provider can have direct and significant consequences even for organisations like Singapore Airlines that are known to have strong cybersecurity postures,” he added.

As cybercriminals increasingly target trusted suppliers and service providers, airlines should strengthen oversight of third-party vendors and ensure they meet security standards comparable to those applied internally, Mr Hia said.

Ultimately, protecting passenger information is a shared responsibility among airlines, technology providers and other booking partners, said Dr Tan.

Want an issue or topic explained? Email us at digitalnews [at] mediacorp.com.sg. Your question might become a story on our site.