Travel booking systems used by millions of people every day are woefully insecure and lack modern authentication methods. This allows attackers to easily modify other people’s reservations, cancel their flights and even use the refunds to book tickets for themselves. The three major GDS operators in the world are Sabre, Travelport and Amadeus and together they store PNRs for hundreds of millions of travelers at any given time. Any data added or modification made to a booking is stored in their systems and all that’s required to access that information is typically a last name and a booking code.”]