There was a post the other day that Amadeus (one of the major backend GDS systems) had been persistently exposing passenger information via a vulnerable endpoint since 2023

So that or similar other hacks