CNA Explains: Your flight booking details have been leaked. What can hackers do with them?

How can hackers misuse your data?

The biggest risk is that criminals could use stolen booking information to carry out convincing scams, cybersecurity experts told CNA.

With access to a passenger’s name, booking reference and travel itinerary, scammers could send emails or messages impersonating an airline or travel agency.

For instance, a passenger could receive a message claiming that their flight has been cancelled or rescheduled, complete with their actual destination and travel dates.

Such messages could trick passengers into clicking fraudulent links, revealing passwords or handing over credit card details.

“The near-term risk is the high chance of scams by email, SMS or phone that mention a real booking – affected users may be tricked into handing over credentials or card details,” said Associate Professor Zhang Tianwei of Nanyang Technological University’s College of Computing and Data Science.

Dr Bernard Tan, a consultant from Protiviti Singapore, noted that while booking information alone may not give criminals access to bank accounts, credit cards or frequent-flyer accounts, “the risk is that familiar travel details could lead passengers to trust a scam they might otherwise question”.

Beyond phishing scams, criminals could also attempt to gain unauthorised access to passengers’ flight reservations or frequent-flyer accounts.

Depending on an airline’s security checks, someone with a passenger’s booking reference and surname might be able to retrieve a reservation or attempt to change or cancel a flight, Dr Tan said.

Kaspersky’s managing director for Asia Pacific Adrian Hia said other possible risks include account takeover attempts and identity fraud, particularly if email addresses, phone numbers or travel document details were also exposed.

Travel itineraries could also reveal when individuals are away from home or attending specific events, potentially posing privacy or physical security risks, Mr Hia added.

Stolen booking information could also be sold to other cybercriminals and used in future attacks.

“Rather than being exploited immediately, compromised personal information is often aggregated into large datasets and sold to other threat actors, sometimes at surprisingly low prices,” Mr Hia said.

“These datasets can then be combined with information from other breaches to build more complete profiles of individuals, making subsequent attack attempts significantly more convincing and effective.”

Assoc Prof Zhang similarly warned that stolen information could be misused months or even years after a breach.