Worrying data breach at CAL

Asha Javeed

Con­tribut­ing Writer

[email protected]

A da­ta breach with­in one of Caribbean Air­lines’ (CAL) third-par­ty tech­nol­o­gy ser­vice providers has ex­posed the da­ta of some of its cus­tomers.

Ac­cord­ing to an email sent to af­fect­ed CAL pas­sen­gers yes­ter­day, the breach of CAL’s reser­va­tion and book­ing sys­tems hap­pened on No­vem­ber 5.

“On 5 No­vem­ber 2026, Caribbean Air­lines was in­formed that an unau­tho­rised par­ty gained ac­cess to cer­tain reser­va­tion in­for­ma­tion through a com­pro­mised sys­tem ac­count. Based on the in­for­ma­tion cur­rent­ly avail­able, your reser­va­tion record may have been af­fect­ed. Both Caribbean Air­lines and the third-par­ty ser­vice provider are ac­tive­ly in­ves­ti­gat­ing the in­ci­dent. The in­ves­ti­ga­tion is on­go­ing, and we do not yet have all their in­for­ma­tion nec­es­sary to con­firm the pre­cise da­ta el­e­ments as­so­ci­at­ed with your reser­va­tion that may have been ac­cessed,” the email said.

While CAL did not iden­ti­fy the com­pa­ny that han­dles its reser­va­tion and book­ing sys­tem in its email, Guardian Me­dia has learnt that it is man­aged by the in­ter­na­tion­al firm, Amadeus.

The email said the in­for­ma­tion po­ten­tial­ly af­fect­ed “may in­clude reser­va­tion-re­lat­ed de­tails such as your name, book­ing ref­er­ence, trav­el itin­er­ary, con­tact in­for­ma­tion, and oth­er in­for­ma­tion con­tained in your book­ing record. Not every reser­va­tion record con­tains the same in­for­ma­tion.”

CAL has not made the breach pub­lic ex­cept to iden­ti­fied cus­tomers. Guardian Me­dia was told that the com­pa­ny had a le­gal re­quire­ment to do so be­cause of da­ta pro­tec­tion laws in the var­i­ous ju­ris­dic­tions in which it op­er­ates.

A com­pa­ny of­fi­cial yes­ter­day con­firmed the breach did oc­cur but de­clined to give more in­for­ma­tion be­cause of the in­ves­ti­ga­tion. The of­fi­cial told Guardian Me­dia that CAL is reach­ing out to af­fect­ed pas­sen­gers on­ly and not­ed that no pay­ment card da­ta was ex­posed. There was al­so no word on how many cus­tomers were af­fect­ed.

“At this time, we are not aware of any ev­i­dence that your in­for­ma­tion has been mis­used. How­ev­er, as a pre­cau­tion, we rec­om­mend that you re­main alert for un­ex­pect­ed emails, mes­sages, or phone calls that ref­er­ence your trav­el or book­ing in­for­ma­tion and avoid shar­ing per­son­al in­for­ma­tion un­less you are sat­is­fied that the re­quest is le­git­i­mate,” the email said.

CAL’s email said that Amadeus has tak­en im­me­di­ate steps to con­tain the in­ci­dent, in­clud­ing re­set­ting the com­pro­mised cre­den­tials, en­hanc­ing ac­cess con­trols, and im­ple­ment­ing ad­di­tion­al mon­i­tor­ing mea­sures.

“We will pro­vide you with fur­ther in­for­ma­tion as it be­comes avail­able, in­clud­ing up­dates on the in­ves­ti­ga­tion (and) any ad­di­tion­al steps be­ing tak­en by Caribbean Air­lines or the third-par­ty ser­vice provider. We sin­cere­ly re­gret any con­cern this in­ci­dent may cause. Caribbean Air­lines takes the pro­tec­tion of per­son­al in­for­ma­tion se­ri­ous­ly and re­mains com­mit­ted to safe­guard­ing your per­son­al da­ta through ap­pro­pri­ate se­cu­ri­ty and pri­va­cy mea­sures,” it said.

CAL is the lat­est air­line to be af­fect­ed by the Amadeus breach. Ac­cord­ing to in­ter­na­tion­al me­dia re­ports, mul­ti­ple air­lines that use Amadeus have re­port­ed unau­tho­rised ac­cess to pas­sen­ger da­ta in sys­tems with ex­posed in­for­ma­tion, in some cas­es, in­clud­ing pass­port num­bers and con­tact de­tails.

Some of the af­fect­ed air­lines that have ac­knowl­edged an Amadeus breach are Scan­di­na­vian Air­lines, Japan Air­lines, Thai Air­ways, and Cathay Pa­cif­ic

Ac­cord­ing to in­ter­na­tion­al re­ports, the ac­cess oc­curred be­tween Au­gust 2023 and Sep­tem­ber 2026, and Amadeus no­ti­fied car­ri­ers of the breach be­tween Oc­to­ber 20 and Oc­to­ber 28, based on dates pro­vid­ed by mul­ti­ple air­lines. A state­ment by Amadeus on Oc­to­ber 30 said there was a vul­ner­a­bil­i­ty af­fect­ing its trav­el book­ing dis­play en­vi­ron­ment that made cer­tain book­ing da­ta ac­ces­si­ble, but there is no ev­i­dence that pay­ment or fi­nan­cial da­ta was ac­cessed.

Oth­er air­lines have iden­ti­fied how many of their cus­tomers were af­fect­ed: Japan Air­lines said ap­prox­i­mate­ly 92,000 cus­tomers of Japan Air­lines and Japan Transocean Air were af­fect­ed, in­clud­ing about 2,000 whose ex­posed in­for­ma­tion in­clud­ed ad­di­tion­al per­son­al de­tails such as pass­port num­bers, while Cathay Pa­cif­ic said ap­prox­i­mate­ly 53,000 book­ings were af­fect­ed.

Lo­cal­ly, the most sig­nif­i­cant da­ta breach oc­curred on Oc­to­ber 9, 2023, at TSTT but was on­ly made pub­lic on Oc­to­ber 27, af­ter Fal­con Feeds, an In­dia-based tech­nol­o­gy se­cu­ri­ty com­pa­ny, re­port­ed on its X so­cial me­dia ac­count. It claimed to have ac­cess to 6GB of or­gan­i­sa­tion da­ta. On Oc­to­ber 28, TSTT said in a state­ment that there was no com­pro­mise of cus­tomer da­ta. On No­vem­ber 3, TSTT ad­mit­ted that 6GB, or less than one per cent of the petabytes of the com­pa­ny’s da­ta—1.2 mil­lion en­tries—was ac­cessed, but that the ma­jor­i­ty of its cus­tomers’ da­ta was not ac­quired and no pass­words were com­pro­mised.

Mean­while, the Caribbean Air­lines (CAL) board yes­ter­day took is­sue with state­ments made by for­mer Fi­nance Min­is­ter Colm Im­bert.

In a state­ment yes­ter­day, the board said it nev­er sought a $1 bil­lion bailout from the Gov­ern­ment or that its for­mer act­ing chief ex­ec­u­tive Nir­mala Ra­mai had left the or­gan­i­sa­tion.

CAL said Ra­mai is still the com­pa­ny’s Chief Op­er­a­tions Of­fi­cer and con­tin­ues to serve as a se­nior mem­ber of the air­line’s Lead­er­ship Team.

“The Board firm­ly re­jects the for­mer min­is­ter’s crit­i­cism of its stew­ard­ship, which stands in di­rect con­trast to the record of gov­er­nance un­der the tenure of the pre­vi­ous Board. Dur­ing that pe­ri­od, the pre­vi­ous Board of Di­rec­tors of Caribbean Air­lines was rep­ri­mand­ed for fail­ing to fol­low the ap­pro­pri­ate pro­cure­ment re­quire­ments in the ac­qui­si­tion of sev­er­al ser­vices. In fact, the for­mer min­is­ter him­self wrote to the then Chair­man on De­cem­ber 23, 2024, iden­ti­fy­ing in­stances of non-com­pli­ance with the Pub­lic Pro­cure­ment and Dis­pos­al of Prop­er­ty Act, 2015,” it said.

“Man­pow­er re­ports al­so showed that the pre­vi­ous Board ap­point­ed per­sons to po­si­tions with­in the or­gan­i­sa­tion with­out ad­her­ence to an ap­pro­pri­ate re­cruit­ment process and with­out re­gard to the ap­proved or­gan­i­sa­tion­al chart. Fur­ther, the back­log of nine years of unau­dit­ed fi­nan­cials can­not be over­looked; con­trary to pru­dent gov­er­nance, these unau­dit­ed fi­nan­cials were used to award bonus­es to a Se­nior Ex­ec­u­tive at that time, it said.

The board said the bur­den of clean­ing up these ir­reg­u­lar­i­ties, which speak to over­all poor gov­er­nance, now rests with the cur­rent Board and Man­age­ment.