What’s next after airlines? Asia data breach raises wider cyber fears

A massive data breach that affected several airlines across Asia has underscored the need for industries in the region to revisit their reliance on third-party suppliers, analysts have said, warning that more critical infrastructure may soon be affected.

Last week, a wave of airlines reported that customer information was accessed in a data security breach involving Spanish software provider Amadeus.

Several of these breaches involved information found in booking details, including flight data, passenger names, booking reference numbers and travel itineraries.

Cathay Pacific said on October 30 that the breach affected about 53,000 bookings, with additional personal information exposed in a subset of cases, but its systems and operations were fine. There was also “no evidence that financial or payment information was accessed”.

Singapore Airlines, the city state’s flagship carrier, made similar claims, noting in a statement on Tuesday that the breach affected a total of 46,000 booking records made between August 2023 and September.

Other affected airlines that reported recent customer data breaches include Malaysia Airlines, Japan Airlines, ANA, Qantas and South Korea’s Asiana Airlines.

In a statement to This Week in Asia, Amadeus said it “became aware of a vulnerability affecting a travel booking display environment”, where certain booking-display data was accessible.

“Although our investigations continue, we can confirm that there is no evidence that payment or financial data was accessed,” it said, adding that there were no indications the vulnerability “has been exploited for ransomware purposes”.

The company said it implemented measures to fix the vulnerability, enhanced monitoring and detection capabilities, and was in “direct dialogue with our customers and authorities”.

Tony Ridley, chief security and risk adviser at EMA Global, said the duration and concentration of the breach were concerning.

“One provider’s weakness reached many airlines at once, and the airlines learned of it from the vendor weeks after the vendor knew,” Ridley told This Week in Asia.

Ridley warned that the near-term risk to passengers could involve targeted phishing that would be more convincing because it used information from an actual trip. A name and a valid booking reference “[are] often enough to open a booking online” and could risk further compromise, he said.

Other details also open up further risk.

“Passport information means you could face identity theft,” said David Gee, a non-executive director, risk adviser, and former chief information security officer of organisations such as HSBC.

Gee said the Amadeus breach was reminiscent of a February 2021 cyberattack on aviation IT and data services provider SITA – which targeted its Passenger Service System servers – and indicated “poor risk management” on Amadeus’ end, such as lapses in its multi-factor authentication (MFA) system.

“The concern is that someone came in with compromised credentials, a login and a password, and was never kicked out. Normally accounts have to be renewed or have some sort of credential that expires, and it looks like this one hasn’t … based on the evidence, I’d say there have been gaps in [their] MFA policy,” Gee said.

Ridley pointed out that the Amadeus breach reflected “different failures and different fixes”, as several airlines had reported an unauthorised party using credentials assigned to an Amadeus system account.

“The window the airlines report, August 2023 to September 2026, matters more than the motive: access that long without detection is the central question,” Ridley said.

Analysts warn that the scheme likely targeted specific individuals for a sophisticated level of fraud.

“They’re probably after very specific individuals – ‘who’s moving around, who could we potentially defraud?’ It’s a very advanced fraud opportunity because they know where you’re going and come across as very credible,” Gee said.

“For most people, the realistic harm is convincing fraud: an email or call that knows your name, flight and booking reference, asking you to pay a fee or confirm details. Where passport numbers were exposed, add identity misuse,” Ridley said.

However, the breach also poses additional risks, as travel history and itineraries reveal certain patterns of movement.

“[This] matters for executives, officials, journalists, and anyone with a reason to be targeted,” Ridley said.

Analysts have warned consumers who have booked with affected airlines in the past three years to be more vigilant about unexpected messages.

“If you’re a high-profile person or an official, take extra caution, because you’re the one being targeted,” Gee said. Consumers in general should also “be on extra lookout for messages from airlines that don’t come from the app, or emails that look right but offer a travel upgrade for some payment. They know a lot about you, and that’s what makes those messages convincing”.

Gee advised consumers to take extra steps such as changing passwords and securing accounts with MFA. “And be aware, for the next 10 to 15 years, of anything that looks too good to be true.”

Consumers should also treat unexpected messages about a booking with suspicion, “even if it quotes correct details”, Ridley said, and visit an airline’s app or website directly instead of clicking links or calling numbers that were sent.

Third-party risk

The incident has highlighted the region’s dependence on shared platforms, and analysts warn that the breach could soon extend to other critical sectors.

“I wouldn’t single out Asia-Pacific as more vulnerable. What this case shows is where the region’s dependence on shared platforms is greatest, and where its arrangements for dealing with a vendor breach are weakest,” Ridley said.

Any sector where competitors ran on the same shared platforms, such as hospitality, financial services and payments, healthcare, logistics, retail, ports, telecommunications, and government and educational institutions, risked similar attacks, he said.

Gee warned that critical infrastructure, such as banks and water and power systems, was at risk of being targeted.

“We have to think about the top of the pyramid, the most critical industries for the country. How do those players organise to work well together to defend, and how do they make sure their supply chain is protected? Right now, it’s not,” Gee said.

“Any third party without mature cyber practices is a target.”

Gee also warned that AI integrated into enterprise tools could potentially compound these risks, and that AI security across organisations was “generally immature”.

“It’s a brand new area and they don’t have controls in place,” he said.

“[What could be] next is the AI these third parties are using, which the company sometimes doesn’t even know about. Most organisations aren’t there yet, so we need to start working on our maturity for AI security.”