The Boardroom Brief Wednesday, November 11, 2026 · Maverick · 3-minute read |
The Reservation. |
A booking vendor held the flight list. One airline has now told its customers how far that file went. |
Good morning. The booking file was not on Finnair's servers. The vendor held it, and the airline is the one putting numbers on the incident this week. Quick ask: reply with the vendor that holds your travel bookings, and whether you could name the controller this morning. I read every reply. |
Today in 30 seconds | ▪ | Finnair: about 116,000 reservations are in an Amadeus breach. |
| ▪ | California: FedEx must pay $2.975 million and fix broken opt-out tools. |
| ▪ | Manila: the privacy commission now has breach notices from ten agencies. |
|
|
The Move Your customer file may sit in a vendor system you do not operate, and the vendor may be the controller when something goes wrong. Ask the CISO and general counsel for a 30-day map of every travel, booking, or reservation vendor that holds employee or customer data, who the contract names as controller, and how you would notify people if that vendor is hit. Know who holds the itinerary before the airline has to tell you. |
|
01 · Vendor risk · Travel Finnair puts 116,000 reservations on an Amadeus breachFinnair said Monday that Amadeus, a global reservation and ticketing vendor, reported a breach of flight lists from several airlines, including about 116,000 Finnair reservations. About 750 were opened for examination, 30 tied to Aurinkomatkat packages. Amadeus says the activity has been stopped, cards and passwords were not accessed, and Finnair systems were not compromised. Amadeus is the data controller and has notified an EU authority. Finnair will email customers it can reach. Why it matters: If a booking vendor holds the file, your systems can be clean and your customers still get the letter. The contract should already say who notifies whom, and how fast. Source: Finnair |
02 · Enforcement · California California posts a $2.975 million FedEx privacy orderThe California Privacy Protection Agency published a November 6 decision requiring FedEx to pay a $2,975,000 fine within 30 days of the order taking effect. The order finds FedEx said it did not sell or share personal information while running tracking tools for cross-context behavioral advertising, failed to honor opt-out preference signals, and its cookie controls and webform did not stop all sharing. It also requires quarterly scans and tests, plus a working opt-out link. Why it matters: A cookie banner that does not actually stop the sale is now an enforcement file. Test the opt-out the way a regulator will. Source: California Privacy Protection Agency |
03 · Public sector · Philippines Manila confirms breach notices from ten agenciesThe Philippines National Privacy Commission said Tuesday that, as of November 10, it has received personal data breach notifications from ten government agencies, including the Bureau of Internal Revenue, the Securities and Exchange Commission, the Department of Justice, and the Coast Guard. Officials said each notice is under review, and that agencies remain accountable for personal data even when processing is outsourced. Why it matters: A notice to the regulator is not the last step. If your public-sector work sits with a subcontractor, the controller duty still sits with the agency, and often with you. Source: National Privacy Commission |
History rhymes 2018: Marriott showed how long a reservation file can sit openIn November 2018 Marriott said attackers had been inside the Starwood guest reservation database since 2014. The first public count ran into the hundreds of millions of guests. A reservation system can outlast the brand that built it. |
Put these to management | 1. | Which travel, booking, or reservation vendors hold our employee or customer data, and who does the contract name as the controller? |
| 2. | If that vendor is breached tomorrow, who notifies our people, from which contact list, and how fast have we tested that? |
| 3. | Do our cookie banners and opt-out signals actually stop the sale, or just look like they do? |
|
|
From the archive: The Airlock. The UK accepted 44 recommendations on AI in healthcare and opened another Airlock round. Read it beside today. |
See you tomorrow at 7. Maverick Know someone who should be in the room? Forward this, or send them your link. Found this in Promotions or Spam? Drag it to your Primary tab so tomorrow's Brief lands where you will see it. The Boardroom Brief · daily at 7 a.m. ET · theboardroombrief.news |
