Luggage mix-up: Techie hacks airline site to get co-passenger’s contact

NT Correspondent

Air travel can be very harrowing sometimes, even for seasoned travellers. There are so many things that one needs to look out for - tickets, identity cards, boarding passes, cell-phones, and of course luggage. The worst nightmare for a passenger is to find his luggage missing at the destination point.

A message shared by a private airline passenger has gone viral after he claimed that he found a ‘vulnerability’ in the airline’s website, using which he was able to find the phone number of a co-passenger with whom his bag got swapped by mistake.

Nandan Kumar, whose profile on social media describes him as a software engineer, who was travelling from Patna to Bengaluru by a private airline, had his luggage mistakenly picked up by a co-passenger. The software savvy Kumar decided to put his skills to best use to find his lost luggage by hacking into the airline’s website.

Kumar took to social media and shared the story of how he retrieved his luggage. He also narrated the entire incident and told the private airlines about the loopholes in their website.

“Hey, Want to hear a story? And at the end of it I will tell you hole (technical vulnerability) in your system?” is how Nadan starts the story.

Kumar wrote, “So, I travelled from ‘PAT - BLR (6E185)’ yesterday. And my bag got exchanged with another passenger. Honest mistake from both our ends. As the bags were exactly the same with some minor differences.”

He contacted the customer service of the airline which tried to contact the other passenger “but all in vain.” Kumar then decided to take the matter in his own hands and this is where the story gets interesting.

“I pressed the F12 button on my computer keyboard and opened the developer console on the website and started the whole checkin flow with network log record on,” he wrote.

“And there in one of the network responses was the phone number and email Id of my co-passenger. Ah this was my low-key hacker moment and the ray of hope. I made note of the details and decided to call the person and try to get the bags swapped,” the software developer added.

Kumar’s effort yielded results and both the passengers swapped bags.

Here the passenger highlighted two problems with the airline here: one, their poor customer care service; and two, the data leak.

The airline took notice of Nadan’s story and responded with an apology for the inconvenience and assured that the website has no security lapses.

“Any passenger can retrieve their booking details using PNR, last name, contact number, or email address from the website. This is the norm practiced across all airline systems globally,” the airline stated in a message.