Unauthorized access to systems at Amadeus, the Madrid-based¹ company that supplies reservation, ticketing and check-in technology to more than 400 airlines², has exposed passenger data from several carriers. Singapore Airlines was the latest to disclose it, on November 3³, with about 46,000 booking records. Amadeus says⁴ there is no evidence that payment data was accessed and that its investigation continues.

• ▹September 21: Amadeus is told of a potential vulnerability in a booking "display environment", according to what it told heise⁵.
• ▹September 24: Amadeus detects the unauthorized access but doesn't tell ANA that day, according to the airline's timeline⁶.
• ▹October 1: Amadeus publishes a short statement² with no figures and no airline names.
• ▹October 13: heise reports⁵ a memory dump reachable without authentication, holding credentials and admin passwords, and says passenger data could be viewed in plain text.
• ▹October 16: ANA hears about it from other airlines and asks Amadeus⁶.
• ▹October 20: Amadeus notifies ANA, Korean Air⁷ and Asiana⁸. Japan Airlines² gets the notice on the 23rd and Cathay Pacific⁹ on the 28th.

• ▹Japan Airlines and Japan Transocean Air: about 92,000 customers². About 2,000 cases also include email, phone, passport and nationality.
• ▹Cathay Pacific: about 53,000 bookings⁹. A smaller subset also includes contact details, travel documents or frequent flyer numbers.
• ▹Singapore Airlines: about 46,000 records³, around 620 of them with email, phone and travel document details.
• ▹ANA: about 37,800 customers⁷, around 1,700 with extra data such as passport numbers. Star Flyer, Air Do and Solaseed Air have also issued notices after hearing from ANA.
• ▹Korean Air⁷ and Asiana⁸: booking numbers for some customers, no total given.
• ▹Malaysia Airlines¹⁰: says some customer data may be affected, no figure.
• ▹Condor: has confirmed it to the German press¹¹, no figure.
• ▹Qantas: still checking¹² whether its bookings are involved.

These numbers can't be added up, because some count customers and others count bookings. Amadeus declined to say¹³ how many victims there are overall.

• ▹Type the airline's address yourself, look for its notice and check your upcoming bookings.
• ▹Be wary of any message that mentions your flight and asks for money, your card or your ID, even if the details are right. Here's how to spot a phishing email.
• ▹If in doubt, call the number on the official website, never the one in the message.
• ▹If you have a flight coming up, ask whether they can change your booking reference.
• ▹If you're told your passport was among the data, keep the notice and ask the airline what it recommends.
• ▹In Spain, INCIBE's 017 helpline¹⁴ is free and confidential if you're unsure about a message.

So it's worth checking what your contract says about notification. Article 33 of the GDPR¹⁵ requires a processor to notify the controller without undue delay, and the controller to notify the authority, where feasible, within 72 hours of becoming aware. On ANA's timeline⁶, 26 days passed between detection and its notice. I'm not saying Amadeus broke any rule: I don't know when it learned whose data was involved, and I'm not aware of any ruling on this. My point is that your response plan can't depend on your supplier telling you quickly.

If you have a technical team, there are two clear jobs. System accounts need password rotation, least privilege and alerts for unusual activity. And if you use Spring Boot, check that the heapdump endpoint isn't open to the internet: heise doesn't say exactly which endpoint this was, but the official documentation¹⁶ keeps it restricted by default, so opening it is a decision somebody makes.