\n<\/p>\n
SINGAPORE: Around 46,000 Singapore Airlines (SIA) booking records were recently accessed in a <\/span>data breach<\/span> involving its software provider Amadeus.<\/span><\/p>\n The exposed information included passengers’ names, booking references and travel itineraries, while some records may also have contained contact details and KrisFlyer membership numbers.<\/span><\/p>\n But what can cybercriminals do with such information, even without access to passwords or credit card details?<\/span><\/p>\n CNA asked cybersecurity experts about how stolen airline booking records could be misused, whether similar incidents have occurred before and what affected passengers can do to protect themselves.<\/span><\/p>\n According to a media statement by SIA on Tuesday (Nov 3), the data accessed during the breach included passengers’ names, booking reference numbers, travel itineraries and booking classes.<\/span><\/p>\n For around 620 of the affected records, additional information such as email addresses, phone numbers, travel document details and KrisFlyer membership numbers may also have been accessed.<\/p>\n Airline booking records can contain a range of other information, depending on how a trip was arranged.<\/p>\n According to Amadeus’ website, such records may include cabin classes, departure and arrival airports, as well as supplementary services booked through travel agents, such as hotel stays, airport transfers and rental cars.<\/span><\/p>\n The biggest risk is that criminals could use stolen booking information to carry out convincing scams, cybersecurity experts told CNA.<\/p>\n With access to a passenger’s name, booking reference and travel itinerary, scammers could send emails or messages impersonating an airline or travel agency.<\/p>\n For instance, a passenger could receive a message claiming that their flight has been cancelled or rescheduled, complete with their actual destination and travel dates.<\/p>\n Such messages could trick passengers into clicking fraudulent links, revealing passwords or handing over credit card details.<\/p>\n \u201cThe near-term risk is the high chance of scams by email, SMS or phone that mention a real booking – affected users may be tricked into handing over credentials or card details,\u201d said Associate Professor Zhang Tianwei of Nanyang Technological University\u2019s College of Computing and Data Science.<\/span><\/p>\n Dr Bernard Tan, a consultant from Protiviti Singapore, noted that while booking information alone may not give criminals access to bank accounts, credit cards or frequent-flyer accounts, \u201cthe risk is that familiar travel details could lead passengers to trust a scam they might otherwise question\u201d.<\/span><\/p>\n Beyond phishing scams, criminals could also attempt to gain unauthorised access to passengers’ flight reservations or frequent-flyer accounts.<\/p>\n Depending on an airline’s security checks, someone with a passenger’s booking reference and surname might be able to retrieve a reservation or attempt to change or cancel a flight, Dr Tan said.<\/p>\n Kaspersky\u2019s managing director for Asia Pacific Adrian Hia said o<\/span>ther possible risks include account takeover attempts and identity fraud, particularly if email addresses, phone numbers or travel document details were also exposed.<\/p>\n Travel itineraries could also reveal when individuals are away from home or attending specific events, potentially posing privacy or physical security risks, Mr Hia added.<\/p>\n Stolen booking information could also be sold to other cybercriminals and used in future attacks.<\/p>\n \u201cRather than being exploited immediately, compromised personal information is often aggregated into large datasets and sold to other threat actors, sometimes at surprisingly low prices,” Mr Hia said.<\/span><\/p>\n \u201cThese datasets can then be combined with information from other breaches to build more complete profiles of individuals, making subsequent attack attempts significantly more convincing and effective.\u201d<\/span><\/p>\n Assoc Prof Zhang similarly warned that stolen information could be misused months or even years after a breach.<\/span><\/p>\n<\/div>\nWhat do airline booking records contain?<\/h2>\n
How can hackers misuse your data?<\/h2>\n
\n
\n
Read Full Article At Source <\/a>
\n