Data Breach Across Multiple Asian Airlines After Compromise of Amadeus Booking Platform
What Happened — A cyber‑attack on Spanish travel‑technology provider Amadeus exposed booking‑display data that was accessed using credentials assigned to an Amadeus system account. The breach propagated to several Asian carriers—Japan Airlines (≈92 k records), Cathay Pacific (≈53 k), Singapore Airlines (≈46 k), Korean Air, Asiana Airlines, and Malaysia Airlines—revealing passenger names, booking numbers, itineraries, passport details and frequent‑flyer numbers. Amadeus says no payment data was taken and no ransomware was deployed, but the incident remains under investigation. The airlines report that their own operational systems were not impacted, and they are notifying affected passengers. Source: The Record
Why It Matters for Trust & Control Assurance — The incident highlights the need for robust third‑party risk oversight and continuous monitoring of vendor environments.
Who Is Affected — Commercial airlines in Asia (transportation sector) and their passengers.
Recommended Actions —
- Re‑evaluate third‑party risk assessments for Amadeus and any similar reservation‑system providers.
- Verify that contracts include breach‑notification, data‑protection, and monitoring obligations.
- Collect and retain evidence of vendor security controls for audit readiness.
Technical Notes — Attack vector: compromised system‑account credentials used to access a booking‑display environment. No specific CVE disclosed; the vulnerability was internal to Amadeus’ display platform. Data exposed: passenger personal identifiers, travel itineraries, passport numbers, frequent‑flyer IDs. Source: The Record