Log in Request a demo
Industry · Aviation And Travel

Fake Booking Pages Are Stealing Our Customers.

Travelers search in a hurry and trust the first page that looks right. Criminals copy booking pages and go after loyalty accounts.

Request A Demo See The Platform
What We Watch For Aviation And Travel 4 Threats

In Short

Airlines, airports and travel brands deal with travelers who book in a hurry and with many suppliers. Attacks on aviation and travel often start outside the company: copied booking pages, stolen loyalty logins and a supplier that fails. Watching those places gives you notice before travelers or operations feel it.

At A GlanceFake booking and loyalty pages, account takeover, phishing of travelers and supplier outages, plus the rules that apply to airlines and travel brands.

Main Threats

What Threatens Airlines, Airports And Travel Brands.

Glossary term Fake Booking And Loyalty Pages Criminals register domains close to yours and copy the booking or loyalty login page. Travelers pay or sign in, and the brand takes the blame. See The Definition → Glossary term Account Takeover Stolen or reused passwords are tried on traveler and loyalty accounts. Points and saved details can be turned into money. See The Definition → Incident A Supplier Outage In September 2025 a ransomware incident on systems that support Collins Aerospace's MUSE software hit European airports. Read The Incident → Glossary term Phishing Aimed At Travelers Messages about a delayed flight or a refund that lead to a page asking for payment details. See The Definition →

Compliance

Which Rules Apply To You.

NIS2 Directive The European Commission lists transport among the sectors the directive covers. It asks covered entities to take appropriate cybersecurity risk-management measures and to notify authorities of significant incidents, and applies to medium-sized and large entities. Official Site ↗
PCI DSS The payment card security standard, maintained by the PCI Security Standards Council. It applies to entities that store, process or transmit cardholder data, including merchants, processors, acquirers, issuers and service providers. Official Site ↗
EASA Part-IS (Aviation Information Security) EASA says Delegated Regulation (EU) 2022/1645 applies from 16 October 2025 and Implementing Regulation (EU) 2023/203 from 22 February 2026. They set information security requirements for aviation organizations under EASA oversight and for their authorities. EASA published 22 questions and answers on it. Check with your competent authority whether you are covered. Official Site ↗

A plain summary of who each rule covers, taken from the official page. Not legal advice. Your legal team decides what applies to you.

Products

How Brandefense Helps.

Threat Landscape

Who Targets Aviation And Travel, And Where.

Collins Aerospace MUSE attack on European airports Incident On 19 September 2025 RTX found a ransomware incident on systems that support Collins Aerospace's MUSE software, which lets airlines share check-in and boarding resources at airports. September 2025 · Transport and manufacturing
Germany Country Germany faces cyber espionage by state actors, ransomware against companies and local governments, and DDoS campaigns against critical infrastructure. Europe Indonesia Country Indonesia is a large digital economy where cyber risk is shaped by ransomware, data leaks and fraud against banks and public bodies. Asia Pacific Italy Country Italy faces ransomware, DDoS campaigns by pro-Russian groups and data exposure. Europe Kazakhstan Country Kazakhstan faces fast-growing cybercrime, mostly theft of personal data, and DDoS waves against its national internet and state sites. Asia Pacific Saudi Arabia Country Saudi Arabia is a Gulf state whose energy, aviation, government and telecommunications sectors have been named by official sources as targets of Iran-linked and other state-linked groups. Middle East Taiwan Country Taiwan faces constant cyber pressure that its National Security Bureau ties to China: 2.63 million intrusion attempts a day against critical infrastructure in 2025, by the Bureau's count. Asia Pacific United Arab Emirates Country The United Arab Emirates is a Gulf state with a national Cyber Security Council and separate bodies in Dubai and Abu Dhabi. Middle East United Kingdom Country The United Kingdom faces cyber threats from states and from ransomware crews. Europe
One shared supplier system: Collins Aerospace MUSE, 2025
  1. 19 September 2025RTX becomes aware of a ransomware incidentIt affected systems that support the MUSE passenger processing software that airlines share at airports.
  2. 24 September 2025RTX files an SEC Form 8-K and the UK National Crime Agency announces an arrestRTX said customers moved to back-up or manual processes. A man in his forties was arrested on suspicion of Computer Misuse Act offenses and released on bail.
  3. 2 October 2025Berlin Brandenburg Airport gives a restore dateIt said Collins Aerospace aimed to restore the central system by 5 October 2025.

FAQ

Frequently Asked Questions.

  • Why would criminals copy a booking page?

    Travelers search in a hurry and pay online. A page that looks right collects card details or logins before anyone checks the address.

  • Do you track groups that target aviation?

    This page names no group, because we only name one when a government or standards source links it to the sector. Most threats here are criminal.

  • Does a supplier outage show up in your tools?

    Not as an outage. The platform shows supplier exposure and criminal activity that mentions a supplier, which can give early warning.

  • Which rules does an airline face?

    The NIS2 Directive covers transport. Rules differ by country and by type of operator, so check with your legal team.

  • How does account takeover hit loyalty accounts?

    Stolen or reused passwords are tried on traveler and loyalty accounts. Points and saved details can be turned into money. Dark Web Monitoring alerts you when traveler or staff logins tied to you are offered for sale.

  • What is phishing aimed at travelers?

    It is messages about a delayed flight or a refund that lead to a page asking for payment details. Travelers book in a hurry, so such messages feel real. Phishing monitoring finds pages that copy your booking and loyalty sites.

  • What is EASA Part-IS?

    EASA says Delegated Regulation (EU) 2022/1645 applies from 16 October 2025 and Implementing Regulation (EU) 2023/203 from 22 February 2026. They set information security requirements for aviation organizations under EASA oversight and for their authorities. Check with your competent authority whether you are covered.

  • Why do old campaign sites matter for a travel brand?

    Old campaign sites still face the internet and can be used by criminals. External Attack Surface Management shows the internet-facing systems of your group, including old campaign sites.

  • Does PCI DSS apply to travel brands?

    PCI DSS is the payment card security standard, maintained by the PCI Security Standards Council. It applies to entities that store, process or transmit cardholder data, including merchants, processors, acquirers, issuers and service providers. Your legal team decides what applies to you.

  • Which suppliers expose an airline or travel brand?

    Airlines, airports and travel brands deal with many suppliers, and attacks often start outside the company. The Supply Chain and Vendor Risk use case shows which suppliers expose you.

Mentioned In
  1. Tailwind Airlines Secured 100K+ Customers With Proactive Digital Risk Protection →April 2024
  2. A Phishing Campaign Targeting Hotels and Travel Companies Detected →August 2022
  3. APT33 →Threat group

Related Reading.

Knowledge Hub →
101 guide Phishing 101 What phishing is, why it keeps working and the practical steps that reduce the risk for your company and your customers. Open → 101 guide External Attack Surface Management 101 How to find, check and reduce everything an attacker could reach from the internet, and how to keep that list true as your company changes. Open → 101 guide Threat Intelligence 101 A plain introduction to threat intelligence: what it is, how it works and how a small team can start using it. Open →

Other Ways In.

All Roles →
RoleFraud and brand protectionFind fake sites, apps and accounts that use your name early, and follow each takedown to… RoleBrand and marketing leadFind fake sites, fake ads and impersonated profiles before customers do, and see what was removed. Threat groupAPT33MITRE ATT&CK describes APT33 as a suspected Iranian threat group active since at least 2013, with… Glossary termRansomwareRansomware is malware that encrypts files and systems so they become unusable until a ransom is…

For Aviation And Travel

Stay Ahead Of Digital Threats.

Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.

Request a demo See The Platform