Advice for travelers on India issue

In January 2019, Amadeus became aware of potential unauthorized and unlaw-ful activity within its independent distributor in India, Resbird Technologies Private Limited (”RTPL”).

A forensic investigation was immediately launched. It determined that there had been no unauthorized access to the system but found that an employee of the distributor, with legitimate access rights to the Amadeus system, had abused her position and illegally extracted certain information from a number of passenger name records. 

The employee illegally transferred this information to an unauthorized third party, WorldSIM India, which markets mobile phone sim cards. As a result of this, some travelers may have received calls or e-mails from WorldSIM. 

The illegally extracted information was accessed through Travel Agency Sales Reports, generated by the employee, and primarily contained name, contact de-tails and travel itineraries. There is evidence that in a very limited number of cases, passport details were among the data accessed. The employee did not have access rights to credit card details.  

The impacted records came from travel agents in India. Only tickets issued in India were involved. 

As a result of the investigation and its findings, the following actions were taken:

• The employee’s access rights were immediately blocked and her employment terminated by RTPL.
• RTPL filed a report with the Indian police 
• Amadeus filed a report on the incident to the Spanish data protection authority
• Amadeus is conducting a systematic review of the data compromised, which goes back to the end of June 2018.
• A cease and desist letter was sent to WorldSIM in the UK and WorldSIM India, demanding the stolen information be returned or destroyed. WorldSIM is yet to respond. Amadeus is now pursuing further legal action to ensure that all stolen records are returned or destroyed.
• RTPL has further intensified its data security measures and monitoring of the systems. Amadeus has appointed an independent forensic security consultant to assist with this incident and is working with RTPL to take further steps to mitigate against any recurrence of such illegal activity. 

RTPL and Amadeus apologize to its subscribers, customers and travelers for any inconvenience caused by this issue.

Amadeus provides a computer reservation system dedicated for use by travel agen-cies, through which they may search for flights and make flight bookings for travel-ers. Therefore, when travel agencies book a trip through the Amadeus system, the booking is then created in our system. The system then stores the data that has been used to make the booking, such as your name, contact details in a what is known as a ‘passenger name record’.

RTPL is Amadeus’ independent distributor in India, distributing the Amadeus system to local travel agencies. RTPL is an independent company with 100% Indian owner-ship.

In the travel industry, a passenger name record is a record in the database of a computer reservation system that consists of the personal information for a passenger and also contains the itinerary for the passenger, or a group of passengers travelling together.

In this instance the employee illegally transferred an extract from the first page of records to an unauthorized third party, WorldSIM India.  WorldSIM India used the data to try to market mobile phone sim card offers to travelers.  

The stolen information primarily contained name, contact details and travel itinerar-ies. There is evidence that in a very limited number of instances, passport details were among the data accessed. 

Credit card information was not accessed. The employee did not have access rights to credit card details. 

If you had a ticket issued in India and received unsolicited marketing messages for mobile/sim offers then your data has potentially been accessed. 

We do not believe that identity theft is the objective of this illegal activity.  We believe the objective of the illegal activity was to harvest contact details and itineraries in order to sell sim cards to travelers.

Two key reasons:

• The records taken came from the first page of records which very rarely includes passport details. 
• We have only seen that WorldSIM has used information provided by the rogue employee for marketing mobile sim cards, where passport details are not relevant or necessary.

We would like to emphasize that no credit card information was accessed as the person did not have access to credit card information. 

Nonetheless, out of utmost precaution, we are monitoring for any unauthorized use of these details outside of Amadeus systems.  

The risk assessment performed shows there is no high risk to the rights and freedoms of individuals, the risk to individuals is likely to be low, with no financial or identity theft impact.

The receipt of direct marketing materials is likely to be an inconvenience rather than create a risk for individuals.

Amadeus takes any loss of customer data extremely seriously. As a result of the investigation into the issue Amadeus is conducting a systematic review of the data compromised. 

Multiple cease and desist letters were sent to WorldSIM in the UK and WorldSIM India, demanding the stolen information be returned or destroyed. WorldSIM is yet to respond. Amadeus is now pursuing further legal action to ensure that all stolen records are returned or destroyed. 

In addition 

• The employee’s access rights were immediately blocked and employment terminated 
• The RTPL filed a report with the Indian police  
• Amadeus filed a report on the incident to the Spanish data protection authority 
• Amadeus has appointed an independent forensic security consultant to assist with this incident.

We appreciate that you are concerned about this. Amadeus and RTPL put the highest priority on the integrity of travelers’ data, and we apologize to all customers and travelers impacted by this situation. 

You can contact Amadeus at dataprotection@amadeus.com if you have any further questions here.