Real PNRs, Fake Refunds: The Amadeus Breach as an Email Security Risk for India's Airlines and OTAs

A breach at a reservation vendor in Madrid is now an inbox problem for security teams in Mumbai, Delhi and Bengaluru. Attackers spent about 37 months reading real airline reservations through Amadeus, then used that data to send phishing emails that contain a customer's correct booking reference, name and route.

No Indian airline or OTA has publicly disclosed exposure so far. That is not the same as being out of reach. The attack is brand-agnostic, the lure is a template, and the thing it defeats is the one control most email security programs still lean on: the assumption that a message with accurate details is probably real. This post looks at the incident through that lens, as an emerging email security risk for India-based airlines and OTAs.

The incident in brief

Amadeus IT Group, which runs the Altéa passenger service system, was breached between August 2023 and September 2026. Access came through compromised administrative system-account credentials and an authorization flaw in a booking-display environment. Amadeus began notifying carriers between October 20 and October 28, 2026, and public disclosures followed.

• Data exposed: Passenger Name Records (PNRs), names, flight dates, routes, booking classes and contact details. For some travelers, also passport numbers, frequent flyer IDs and nationality.

• Not exposed at source: payment card numbers. Card data was collected later, from victims, through phishing.

• Carriers that have disclosed: Japan Airlines (92,000 customers), Cathay Pacific (53,000 bookings), Singapore Airlines (46,000), ANA (37,800), Finnair (about 116,000), Malaysia Airlines, Korean Air, Asiana Airlines, Qantas and others.

• Attribution: an unnamed, financially motivated cybercrime group.

Where Indian carriers stand. No Indian airline appears among the disclosing carriers, and we found no CERT-In advisory on this incident as of November 12, 2026. Amadeus says more than 130 airlines use Altéa, and that figure is the platform's customer base, not the count of confirmed victims.

Why this is an emerging risk for India

Three things make this relevant for an Indian carrier:

• The lure is a template. The observed campaign impersonates Frontier Airlines, but nothing in it is specific to Frontier. Swap the brand, the lookalike domain and the PNR format, and it works against any carrier or OTA. Expect lookalike domains that pair Indian airline and OTA brands with words like crs, cms, refund, pnr and support.

• Your customers may already be in the data. Indian travelers fly the carriers that have disclosed. Those carriers have not published breakdowns by country, so assume some of your customers' PNRs and email addresses are in the stolen set, and that the phishing may reach them under a foreign airline's name while they contact you for help.

• Refund and cancellation email is normal traffic. Airlines and OTAs send refund, cancellation and payment-correction messages every day. A "duplicate fee refund" email looks like business as usual to your customers and to your own staff.

For corporate travel desks, the same data supports targeted business email compromise against travellers who are mid-journey, since itineraries show where staff will be and when.

Anatomy of the lure, from the inbox

The email is built to pass every check a person or a filter normally applies.

1. Accurate personalisation. Each message carries the recipient's real six-character PNR, full name, departure date and city pair. Content-based filtering and "does this look right?" training both lose their signal.

2. A believable pretext. Three themes are used:

   1. A duplicate-fee or airport-tax refund (sometimes several times the ticket value),

   2. A "settlement batch for this reservation has already closed" explanation for why the refund can't go to the card on file

   3. and a warning that an unresolved payment error will cancel the ticket within 24 hours.

3. A clean-looking delivery path. The observed campaign was sent through a compromised third-party business email relay, noreply@reviewpro[.]com, rather than a freshly registered sender. Mail from a legitimate relay is more likely to carry a reasonable sender reputation and pass basic authentication on that relay's own domain, so these checks alone will not catch it.

4. A landing page that captures before you submit. Links lead to portals styled as airline CRS or CMS pages. Client-side listeners send card numbers, expiry dates and CVVs as they are typed, so a customer who gets suspicious and closes the form has still lost the data.

The weak points for the attacker are the click and the page, not the message. That is where detection and takedown effort pays off.

Where email controls fall short, and what to change

Indicators of compromise

These are the observed indicators. Build equivalent patterns for your own brand, for example *[yourbrand]crs.*, *[yourbrand]cms.* and *[yourbrand]refund*.

The takeaway

The Amadeus breach shows how stolen booking data turns routine refund email into a high-conversion attack, and it is brand-agnostic. For India-based airlines and OTAs, the practical move is to stop relying on message accuracy as a trust signal. Verify out of band, enforce your domain protections, watch for lookalikes, and be ready to act before a vendor confirms your own exposure.

About Raven

RavenAI (Raven) is an AI-native, context-aware email security company protecting organisations on Microsoft 365 and Google Workspace. Its LLM engine reads intent, context and identity signals to stop phishing, impersonation, business email compromise and financial fraud that slip past rules-based filters, and its AI-powered DLP stops sensitive data leaving by email. Raven secures millions of emails every day for organisations across fintech, payments, banking technology and insurance, and has been featured in Microsoft's AI First Movers programme.