Airline Discovers Its Passengers Always Belonged to Someone Else

Malaysia Airlines has advised passengers that their personal data was exposed in a breach at Amadeus, a Madrid-based firm that maintains reservation systems for airlines worldwide. The notification came from the airline. The records had never been in the airline's keeping. Somewhere between booking and boarding, a traveler who believed she had entered a relationship with a carrier discovers she was filed by a stranger whose name appears nowhere on her ticket — and the stranger holds her passport number, her birthday, and her seat preference for the aisle.

Observe the trick as performed. Step one: the ticket displays the airline's crest and colors. Step two: the reservation quietly resides on a server in Spain. Step three: the breach occurs there, and the airline issues the apology while the technology firm issues nothing at all. Step four: the passenger checks whom she actually hired, finds the question unanswerable, and boards anyway. In my years with the Octopus Collective of Rigel-7, we kept one ledger because our arms were many but our memory was one; the dominant local primate keeps nine ledgers and remembers none of them.

"Customer trust is our most valuable asset, which is precisely why we entrust it to a partner," explained a Senior Director of Guest Confidence, speaking on condition of being unidentified. Passengers then received guidance urging vigilance against fraudulent messages — a graceful maneuver in which the institution transfers its surveillance duty to the surveilled. "No carrier can guard what it has outsourced. That is what outsourcing is for," noted a Madrid analyst, serene as a filing cabinet.

The stakes are not abstract. What leaked was the full anatomy of a journey: where she sleeps, when she flies, which documents she carries, and whether she prefers the window. A predator need not hack anything further; it need only wait for the follow-up email, which will arrive, because everything else did. "I knew someone had all my information," one passenger confessed, without alarm. "I just assumed it was someone I'd heard of."

The seat was real. The fare was paid. The apology departed from Kuala Lumpur, and the data — like the plane, like the passenger, like the truth of the arrangement — had been in Madrid all along. She will fly again next month. She has already checked in.