Loading story…
A security researcher disclosed multiple vulnerabilities in Frontier Airlines’ website and mobile booking API that allegedly exposed sensitive passenger records using information printed on a boarding pass. According to the reports, a six-character booking code (PNR) and, in many cases, a passenger’s last name were enough to retrieve home addresses, phone numbers, email addresses, dates of birth, passport details, TSA PreCheck or Known Traveler Numbers, Frontier Miles numbers, billing details, and partial payment-card data. One earlier flaw reportedly allowed booking data to be accessed from the PNR alone before Frontier partially remediated it.
The researcher said Frontier was notified in early March under a 90-day disclosure process, but key issues were still reportedly live more than 100 days later. The reports say some data remained hidden only in the user interface while still being exposed through page source or API responses in areas such as Manage My Booking and passenger-edit functions, and that one attempted fix may have revealed even more information. The exposure raised risks including identity theft, stalking, misuse of trusted traveler information, and easier reconstruction of payment-card numbers from disclosed BIN, expiration, billing data, and last four digits.
See affected versions and whether adversaries are exploiting it.
4 events from the most recent confirmed update back to the earliest known activity.
Frontier fixed one endpoint that had exposed booking data from a PNR alone, but other vulnerabilities reportedly remained. According to the reporting, the partial remediation did not resolve the broader exposure and in one case allegedly led to even more information being revealed in source code or API responses.
As of June 18, 2026, the main vulnerabilities were still reportedly unpatched, leaving passport details, contact information, TSA PreCheck data, and partial payment-card information exposed through Frontier's systems. The reports also state Frontier had not publicly responded by that point.
The researcher contacted Frontier again as part of a 90-day disclosure process after the initial report. This follow-up indicated the vulnerabilities had not been fully remediated.
Security researcher BobDaHacker notified Frontier Airlines about multiple vulnerabilities that exposed passenger data through its API and booking-management functionality. The issues reportedly allowed access to sensitive records using booking information from a boarding pass.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
ghacks.net
Open sourcetomshardware.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
CISA warned that **all versions** of the SpiceJet Online Booking System contain two high-severity information disclosure flaws that can expose passenger data to unauthenticated users. The issues, tracked as `CVE-2026-6375` and `CVE-2026-6376`, affect public-facing booking functions and were reported by Owais Shaikh. According to the advisory, one flaw allows attackers to enumerate valid passenger name records (PNRs) because authorization checks are missing and identifiers are predictable, while the other lets anyone retrieve full booking details using only a PNR and last name. The vulnerabilities were rated **CVSS 7.5** by CISA and described in CVE records as `CWE-639` and `CWE-306` weaknesses with low-complexity, network-based exploitation requiring no privileges or user interaction. Successful exploitation could disclose passenger names as well as broader personal, travel, and booking metadata, creating significant confidentiality risk for the transportation sector worldwide. CISA said it had **no evidence of public exploitation** targeting these flaws at the time of publication.
Jun 29, 2026
Basic-Fit disclosed a breach affecting about **200,000 customers in the Netherlands** after unauthorized access allowed attackers to download personal data before the intrusion was stopped. The exposed information included membership details, names, addresses, email addresses, phone numbers, dates of birth, and **bank account details**. The company said it notified affected customers and reported the incident to the Dutch Data Protection Authority, while media reports indicated the wider impact may extend beyond the Dutch customer base and raised questions about controls that failed to prevent large-scale data exfiltration. Booking.com also warned customers that unauthorized third parties may have accessed reservation-related information after suspicious activity was detected on a number of bookings. The potentially exposed data included customer names, email addresses, phone numbers, and other booking details submitted during the reservation process. Booking.com said the full scope of the incident remains under investigation, reset PIN codes tied to affected reservations, and urged customers to watch for suspicious activity and phishing attempts leveraging the stolen information.
Jun 29, 2026
Manchester Airports Group (MAG) disclosed that customer data linked to Manchester, Stansted and East Midlands airports was accessed and later published by the FulcrumSec extortion group after reported ransom negotiations failed. The incident affects roughly **8.7–8.8 million** people using parking, lounge, Fast Track and airport Wi-Fi services; exposed records reportedly include contact details, vehicle-registration and postcode information, booking history, and some upcoming 2026 travel records. MAG said airport operations, aviation security and passenger safety were not affected, and the UK ICO is assessing its breach notification. FulcrumSec said it obtained MAG’s Iterable server-side API credentials from publicly accessible Next.js JavaScript bundles, not through a conventional network intrusion. The credentials were reportedly exposed from mid-2022 until August 2026 and could enable bulk customer-data exports as well as potentially destructive user-management API actions; independent researcher Scott Helme said he verified the technical basis of the claim. Organizations should ensure server-side API keys are never embedded in client-delivered code, rotate exposed credentials, review third-party SaaS audit logs, and assess data-access and account-management activity for affected integrations.
Sep 10, 2026