Common-use platforms are why terminals can flex, and why one supplier failure degrades four countries at once. Nobody in the contract chain prices that.
Up to six million customers exposed in 2025; records published in 2026. Notification law assumes an incident that ends.
Check-in, boarding and baggage degraded across four capitals through one shared platform. Manual fallback is what kept it to queues.
Customer data through a supplier, with the airline flying normally throughout. Aviation now appears here through both operations and data.
Publication is its own phase, timed for reasons unrelated to the victim. Nobody is required to tell affected people when it happens.
The industry that invented blameless incident analysis handles cyber incidents with commercial confidentiality instead.
There is no packet to inspect and no domain to block. The output of the call is a legitimate action by an authorised person.
A subsidiary carries the parent’s brand and data relationships, frequently with a fraction of its security capability.
Heathrow, Brussels and Berlin degraded through one supplier none of them was attacked. The 2026 repeat is filed at 26-0406.
The blast radius of a successful social-engineering call is set by an architectural decision made elsewhere — and nobody makes that decision thinking about social engineering.
A safety regime, built for other purposes, produced the segmentation that a security argument has repeatedly failed to fund elsewhere.
An airline reading about Hawaiian on a Monday had, at most, a fortnight.
An authentication estate is only as strong as its weakest enabled option — and disabling produces an outage with a name attached.
The answers were true before the employer collected them, and they stay true afterwards.
An attempt that stops a carrier’s morning departures has succeeded at everything but encryption.