Germany's federal cybersecurity agency, the BSI, has advised travellers to be cautious about early check-in emails and similar links, citing vulnerabilities in systems run by Amadeus — the travel-technology company whose reservation and check-in software sits behind a large share of the world's airline bookings, Heise reported on October 15.
WHY THE SCALE IS UNUSUAL Airline IT is one of the least visible and most concentrated pieces of global infrastructure. A single passenger-service system can process check-in, seat selection and boarding for dozens of carriers; when a flaw is found in that layer, the blast radius is measured in carriers and countries rather than in one airline's app. A national agency issuing travel-facing advice — rather than a technical advisory aimed at operators — suggests it judged the risk to ordinary travellers worth a public warning.
WHAT TRAVELLERS CAN DO Practical precautions are unglamorous. Do not click check-in or itinerary links in unexpected emails. Navigate to the airline's own website or app and log in directly. Treat urgent-sounding messages about bookings, refunds or seat changes as suspect until verified through a channel you initiated yourself.
WHAT REMAINS UNCLEAR The technical specifics — which systems, which class of flaw, whether exploitation has been observed — are not established in the source available to us. Specifics should be treated as unconfirmed pending Amadeus's and the BSI's own advisories.
