What’s in a Boarding Pass Barcode? A Lot
Summary: A KrebsOnSecurity reader named Cory decoded the barcode on a friend's boarding pass posted to Facebook and recovered the passenger's name, frequent flyer number, and record locator, then used that data on Lufthansa's website to view all future Star Alliance flights booked to the account. The access also exposed a phone number and the name of the person who booked the flight, and allowed seat changes and cancellation of future flights; the barcode standards are published by IATA and have been available for years.
What you should know: A frequent flyer number and record locator pulled from a photographed barcode were enough to reach every future flight on the account, and the same data gets past the early steps of a Star Alliance PIN reset at United's "forgot PIN" page, which then asks for a secret question such as a mother's maiden name.
Read the original at Krebs on Security ↗
- Topics
- Data Breaches
- Related
- TSMC employee data breach linked to cloud provider Cyber Risks · Nov 15, 2026Data Breach at La Poste Subsidiary Maileva Affects 22 Million People in France Cyber Risks · Nov 15, 2026City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents Cyber Risks · Nov 13, 2026