Sabre Corporation

Summary

A China-linked hacking group breached systems at Sabre Corp., a major travel reservations processor for airlines and hotels, and targeted American Airlines. The attackers, previously implicated in compromising U.S. health insurers and stealing military personnel records, infiltrated critical infrastructure supporting air-travel operations. Sabre confirmed unauthorized access to its networks, while American Airlines initiated investigations into potential computer intrusions. The incident exposed vulnerabilities within key components of the national travel industry's reservation and data management ecosystems.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

In August 2015, Sabre Corp., a critical technology provider for the global travel industry, confirmed a cybersecurity breach affecting its systems. The company, which processed reservation data for hundreds of airlines and thousands of hotels, was targeted by a China-linked hacking group known for previous intrusions against major U.S. health insurers and military personnel records. Simultaneously, American Airlines Group Inc., the world’s largest carrier and a Sabre client, disclosed it was investigating potential unauthorized access to its own computer networks. The attacks represented an escalation in the threat actor’s operations, shifting focus to core infrastructure supporting U.S. commercial aviation and hospitality services. Investigators familiar with the incidents characterized the breaches as strategic penetrations of the national air-travel ecosystem.

The hacking group’s operational pattern involved compromising sensitive databases, though specific data exfiltrated from Sabre or American Airlines remained undisclosed. Sabre’s breach notification indicated recent unauthorized access without detailing the duration of intrusion or specific compromised subsystems. American Airlines’ investigation status suggested potential but unconfirmed network infiltration at the time of reporting. The incidents occurred against a backdrop of heightened concerns about state-sponsored cyber espionage targeting transportation and logistics sectors. No customer advisories or operational disruptions were reported by either organization in immediate connection with the breaches. Response actions were limited to breach confirmation by Sabre and ongoing forensic review by American Airlines as of early August 2015.

Sources

Sources available to members: 1 source.