The OT-ISAC (Operational Technology Information Sharing and Analysis Center) published two reports Wednesday warning that cybersecurity risks facing Asia-Pacific aviation extend beyond corporate IT networks to shared technology providers, passenger reservation platforms and airport OT (operational technology). The assessments highlight exposure involving third-party service accounts, remote-access infrastructure, legacy controllers and interconnected supplier services, as well as vulnerabilities affecting baggage-handling systems, airfield lighting, fuel infrastructure and building management platforms.
One report examines unauthorized access to passenger reservation data held in Amadeus passenger service systems (PSS), identifying incidents involving credentials assigned to an Amadeus system account and customer information associated with Japan Airlines, All Nippon Airways, Cathay Pacific and Singapore Airlines.
The reported exposure involved about 92,000 JAL/JTA customers, 37,800 ANA customers, 53,000 Cathay Pacific bookings and 46,000 Singapore Airlines booking records. The origin of the compromised credentials, the attacker’s identity, and the full scope of the incidents remain under investigation. OT-ISAC identified service-account misuse, insufficient oversight of third-party identities and the concentration of passenger data on shared supplier platforms as key concerns, warning that supplier-side access can expose multiple airlines without requiring a breach of their corporate networks.
The assessment also distinguishes the reservation-data exposure from a separately disclosed vulnerability in an Amadeus booking-display environment, noting that no connection between the two issues has been established. A separate Amadeus service interruption at Southwest Airlines on Oct. 9 required manual baggage and boarding processing, but no link to the reservation-data exposure or a cyberattack was reported. OT-ISAC said no direct compromise of airport OT had been established.
Operators should draw six lessons from these incidents. First, provider identities are part of the attack surface, and the system-account misuse described by airlines supports reviewing service-account rights, oversight, and unusual bulk access. Second, a shared provider can concentrate exposure, because one platform can process many organisations’ records even when their own corporate systems are not breached. Third, diagnostic environments deserve separate attention. Amadeus acknowledged a booking-display vulnerability, but its relationship to the reservation-data incident remains unproven.
Fourth, cyber incidents should be distinguished from outages, since Southwest’s October service interruption and the Collins MUSE ransomware incident had different known causes. Fifth, long reporting windows are not proof of continuous dwell, so operators should validate access periods, retained logs and the provider’s detection timeline before claiming persistent attacker activity. Sixth, manual fallback requires coordination, and airports, airlines and handlers should exercise check-in, boarding, baggage and passenger-communications dependencies, including staffing.
OT-ISAC assessed that these examples justify targeted supplier assurance, identity monitoring and continuity exercises. They do not establish a general attack-frequency trend or a verified compromise of airport control networks.
Aviation systems also carry related dependency risks. The following are review dimensions, not confirmed weaknesses in any named airline or airport, and they should be applied only where asset inventory, architecture and supplier evidence show the condition exists. A shared platform exists where a vendor, integration or service supports multiple operators or sites.
Long-lived identities are a concern where service accounts, API credentials or privileged integrations are not adequately bounded, monitored or rotated. Diagnostic and non-production exposure arises where test, display, logging, or administrative systems could expose live data or secrets. Supplier-held access is a risk where third-party support privileges or network paths are not fully inventoried or time-limited.
Operators should report credible indicators through their organisation’s security incident process, notify the affected supplier, and assess any regulator or privacy reporting obligations. They may also contact OT-ISAC with non-sensitive sector observations through its published public contact channel.
Several indicators are worth investigating. These include a vendor notice that identifies impacted passenger data or credentials, or that describes an unexplained change to scope. Unusual service-account logins, source locations, bulk queries, or changes in API permissions also warrant attention.
Operators should look for booking or itinerary amendments that are inconsistent with authorised staff and customer activity, as well as suspicious messages that reference authentic booking information or request sensitive details. Known leaked credentials or active tokens associated with relevant supplier integrations are further indicators. Management, diagnostic, or test environments that are exposed to networks that do not require access should also be investigated, as should unexpected vendor sessions or cross-zone traffic into airport operational networks.
The second report identifies remote-access infrastructure as a particularly significant exposure, citing three Ivanti Connect Secure vulnerabilities that the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added to its Known Exploited Vulnerabilities catalog in October 2026. CISA confirmed exploitation of CVE-2026-104935, CVE-2026-111357 and CVE-2026-118527, with some in-memory activity capable of evading a clean result from Ivanti’s Integrity Checker Tool.
OT-ISAC warns that compromised remote-access gateways can provide pathways to credential exposure and lateral movement into engineering, baggage-handling and operational support networks, particularly where gateways facilitate vendor or engineering access. It recommends prioritizing exposed gateways, assessing potential compromise using network and memory evidence, and using monitored, multifactor-authenticated vendor connections through approved jump hosts.
The assessment also highlights cybersecurity weaknesses in legacy aviation communications protocols, including ADS-B, ACARS, and controller-pilot data link communications (CPDLC), which lack standardized or native authentication protections in some implementations.
OT-ISAC points to laboratory research demonstrating injection and disconnection conditions affecting legacy CPDLC links, but cautions against interpreting these findings as evidence of attacks against operational airspace. Its review found no substantiated malicious compromise of Asia-Pacific airside control equipment, while identifying documented global vulnerabilities and regional navigation interference as areas requiring attention. The report calls for stronger surveillance cross-checks, monitoring of communication disruptions, independent navigation backups, and rehearsed voice and terrestrial fallback procedures.
OT-ISAC recommends that airlines and airport operators review supplier access privileges, monitor unusual service-account logins and bulk data queries, preserve authentication and API logs, and rotate affected credentials and tokens. It also calls for mapping third-party access paths into airport networks, enforcing multifactor authentication, segmenting operational networks, monitoring engineering connections, and validating manual fallback procedures for critical airport services.
Last month, OT-ISAC analysis found that Asia-Pacific cybersecurity policy is split between binding critical-infrastructure and OT controls, supervisory inspections, and nonbinding strategies. It covered substantive cybersecurity, critical-infrastructure and OT/ICS policy developments, excluding cyber incidents, threat activity, vulnerability announcements and generic defensive advisories. It detailed the updated status of Singapore’s Digital Infrastructure Bill and added three verified Vietnam policy instruments. However, retrospective additions are dated explicitly; binding measures, formal non-binding policies and draft consultations are distinguished.
