- Singapore Airlines says about 46,000 booking records may be affected by an incident at its reservation technology provider, Amadeus. The airline says its own IT systems were not breached.
- Airlines count the damage in different units, and Amadeus did not say how many customers were affected. Customers hear about it from the airline.
- Ask which suppliers hold your customer data, how fast they must tell you, and whether you can retire the identifiers they hold.
Your data can leak from a building you do not own
A company can keep its own systems clean and still lose its customers' data. That is the idea behind this week's airline news. The risk sat with a supplier. The customers still hear about it from the airline.
Rappler reports that Singapore Airlines made a disclosure on November 3. Roughly 46,000 of its booking records may be affected. The cause was an incident at Amadeus, which runs the airline's reservation technology. The airline also says its own IT systems were not breached.
What was exposed
The airline lists four kinds of data in the exposed records. They are customer names, booking reference numbers, trip itineraries and booking classes. A booking class is the fare category a seat was sold under.
A smaller group is hit harder. For about 620 records, the airline says more data may have been reached. That includes email addresses, phone numbers, travel document details and KrisFlyer membership numbers. KrisFlyer is the airline's loyalty programme.
The airline says Amadeus confirmed two things. Bank and credit card details did not leak. Bookings were not changed.
That limits the harm. It does not remove it. A name, an itinerary and a phone number together show where a person will be and how to reach them.
Why a booking reference matters
A booking reference is a short code. It points to one reservation. In many travel systems, that code plus a surname is enough to view a booking. This is general knowledge, not something the report states.
That makes the code work a little like a password for one trip. If it leaks, someone else may be able to look up that trip. Retiring the old code and issuing a new one is a containment step. It makes the leaked copy less useful.
The report does not say how Singapore Airlines' codes could be misused. It does say the airline is changing them as a precaution.
What is known about the flaw
Amadeus said it knew of a vulnerability in a travel booking display environment. Read plainly, that is a place where booking details are shown. It fits the airline's account that payment data was not involved.
The report gives no more. How the flaw worked is not public in it. This article does not guess.
Rappler also says Amadeus did not answer a question on how many customers were affected.
Several airlines, several ways of counting
Rappler lists other carriers that reported customer data was compromised. They include Cathay Pacific, Japan Airlines and Asiana Airlines. Malaysia Airlines said some customer information may have been affected.
Cathay Pacific cited 53,000 bookings. Japan Airlines cited 92,000 customers. Singapore Airlines cited 46,000 booking records. These are different units. One booking can cover several travellers, and one traveller can hold several bookings.
The figures cannot be added into a total. No total has been given. Each airline is working from its own count.
Customers hear it from the airline
Singapore Airlines says it is reaching out to affected customers with upcoming travel. The goal is to change their booking references as a precaution. The report does not say who carries out the change.
The point stands without that detail. These travellers did not pick Amadeus. They learn of its incident from their airline. Some now have a trip to protect and a message to act on.
A supplier's problem becomes the airline's message to deliver. The supplier, by Rappler's account, did not answer a basic question about scale.
Questions to put to your team
First, which suppliers hold your customers' names, contacts or itineraries? Do you have a current list?
Second, what does each contract say about how fast a supplier must tell you? What must it tell you?
Third, if an identifier you issued is exposed, can you retire it quickly? Singapore Airlines is doing this with booking references.
Fourth, who writes to customers? Is that plan ready before the supplier calls?
You can hand a supplier your data. You cannot hand over the customer's trust.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: Rappler.
