What happened

Travel technology giant Amadeus has disclosed that attackers used valid login credentials for one of its system accounts for around three years. Through that access they reached passenger booking data held for airline customers.

Airlines notifying passengers include Japan Airlines (around 92,000 customers), ANA (around 37,800), Cathay Pacific (around 53,000 bookings), Korean Air and Asiana Airlines.

Why it matters

The attackers did not need an exploit. One valid account, never flagged and never revoked, gave them years of quiet access. It is a reminder that credentials can be the weakest link, and that detection must look at behaviour, not just logins.

How to protect your AWS environment

• Review and remove unused IAM users, access keys and service accounts every quarter.
• Enforce MFA on every human account and rotate machine credentials on a schedule.
• Use behavioural detection, such as Amazon GuardDuty, to spot valid credentials used in unusual ways.

Source: Click to Read the original report (BleepingComputer)