Airlines Industry in the Philippines

The airline industry in the Philippines is a vital component of the nation's economy, facilitating both domestic and international travel. Philippine Airlines (PAL), the country's flag carrier and Asia's first commercial airline, leads the sector as the largest international airline and the only full-service Filipino air carrier offering Business Class, Premium Economy, and Regular Economy services.

`In recent years, the industry has demonstrated resilience and growth. Following a downturn during the COVID-19 pandemic, airlines have rebounded, with PAL reporting a 37% surge in passenger revenues from USD 2.1 billion in 2022 to USD 2.9 billion in 2023. This recovery is further supported by projections indicating a 6.87% annual growth in the Philippine flights market from 2025 to 2029, culminating in an estimated market volume of USD 9.73 billion by 2029.

Why Cybersecurity Matters for Passengers

Cybersecurity is paramount for airline passengers as it directly impacts their safety, security, and travel experience. Airlines handle a wealth of sensitive personal information, from names and addresses to passport numbers and credit card details. A data breach exposes this information, leaving passengers vulnerable to identity theft, financial fraud, and severe disruptions to travel plans. Furthermore, modern aircraft rely heavily on computer systems for critical functions, and cyberattacks could potentially compromise these systems, jeopardizing passenger safety. Disruptions caused by cyberattacks, such as flight cancellations and delays, can significantly impact travel plans, causing immense inconvenience and financial losses. Ultimately, strong cybersecurity measures are crucial for ensuring a safe, secure, and enjoyable travel experience for all airline passengers.

Cybersecurity incidents in the Airlines Industry

As the airline industry becomes increasingly digitized, cybersecurity has emerged as a critical concern. The integration of advanced information and communication technologies enhances operational efficiency but also introduces vulnerabilities. Cyber threats such as data breaches, ransomware attacks, and system disruptions pose significant risks to airline operations and passenger safety. For instance, In September 2022, Philippine Airlines (PAL) reported a cybersecurity breach involving its service provider, Accelya. This incident compromised the personal information of Mabuhay Miles members who registered between 2015 and 2017, affecting approximately 12% of the membership base. Exposed data included names, dates of birth, nationalities, and genders. In response, PAL committed to enhancing the security features of its internal systems to protect customer data.

Courtesy of UNTV News and Rescue

Another example is In July 2024, a global cybersecurity incident disrupted airline operations across the Philippines. Airlines such as Cebu Pacific and Philippines AirAsia experienced system outages, leading to flight delays and cancellations. The Ninoy Aquino International Airport witnessed long queues as check-in processes reverted to manual operations. This event underscored the interconnected nature of airline operations and the cascading effects of cyber disruptions on service delivery.

These incidents emphasize the critical need for robust cybersecurity measures within the Philippine aviation sector. Protecting sensitive customer information and ensuring the continuity of operations are paramount. Collaborative efforts between airlines, service providers, and cybersecurity experts are essential to mitigate risks and enhance the industry's resilience against evolving cyber threats.

Expert Insights

Cybersecurity experts emphasize that the aviation sector faces unique challenges due to its complex infrastructure and high dependency on interconnected systems.

Cybersecurity Posture of Airlines in the Philippines: A Six-Month Performance Analysis 

More info about the metrics: https://securityscorecard.com/wp-content/uploads/2024/01/EBOOK-MethodologyDeepDive-3.0_v2-1.pdf 

Comparative Analysis of 5 leading Airlines in the Philippines, as of January 7, 2025

Overall Trends:

The graph tracks the security score performance of five airlines from August to January.
Performance varies across entities, with some showing stability and others experiencing significant fluctuations.

Top Performers:

• Sunlightair (blue) and Cebu Pacific Air (red) consistently achieve high scores in the A-grade range, reflecting stable and strong security practices.
• These two airlines maintain minimal variation throughout the timeline, demonstrating consistent top-tier performance.

Mid-Performers:

• Flyroyalair (cyan) initially starts in the C-grade range, reflecting moderate performance. However, it experienced a dramatic improvement in December, quickly rising to the A-grade range and becoming a top performer.
• This sharp improvement suggests significant enhancements in security measures or practices during the period.

Consistent Lower Scores:

• Air Asia (purple) and Philippine Airlines (pink) generally score lower compared to others.
• Air Asia begins in the B-grade range but declines to the C-grade range by September, showing a gradual recovery towards B by December.
• Philippine Airlines shows a steady decline from the B-grade range to stabilize in the C-grade range, with minimal recovery over time.

The security score trends reveal varying levels of performance among the airlines over the five-month period. Sunlightair and Cebu Pacific Air stand out as consistent top performers, demonstrating strong and stable security measures. Flyroyalair showed significant improvement, indicating potential investments or enhancements in their security practices.

In contrast, Air Asia and Philippine Airlines struggled to maintain higher scores, consistently performing in the mid to lower ranges. Their gradual decline suggests a need for a more proactive approach to strengthening security frameworks.

Overall, the results emphasize the importance of continuous improvement in security measures to achieve stability and competitiveness in the industry.

Best Practices for Enhancing Cybersecurity in Airlines

To fortify their defenses against cyber threats, Philippine airlines must adopt a multi-faceted approach to cybersecurity. Strengthening IT infrastructure is paramount, involving the deployment of advanced firewalls, encryption technologies, and intrusion detection systems. Regular audits and penetration testing can help identify and address vulnerabilities before they are exploited by attackers.

Employee training is equally critical, as human error remains a leading cause of security breaches. Airlines should conduct regular workshops to educate staff on recognizing phishing attempts and adhering to security protocols. Developing comprehensive incident response plans ensures that airlines can act swiftly and effectively in the event of a cyberattack, minimizing disruption and damage.

Collaboration with Managed Security Service Providers (MSSPs) can provide real-time threat monitoring and specialized expertise. By outsourcing cybersecurity management to experts, airlines can focus on their core operations while maintaining a robust security posture. SecurityScorecard (SSC), a leading cybersecurity ratings platform, may play a vital role in this context. SSC can provide airlines with an objective assessment of their cybersecurity posture and helps identify vulnerabilities across their digital ecosystem. By leveraging SSC’s ratings, airlines can benchmark their security efforts against industry standards, monitor third-party risks, and implement targeted improvements to enhance resilience. Embracing a culture of cybersecurity. Additionally, SSC offers real-time evaluations and insights into cybersecurity posture, and has made it easier to handle emergencies. Continuous monitoring and improvement are ensured by utilizing Vulnerability Assessment and Penetration Testing (VAPT) techniques. Long-term resilience requires all organizational levels to adopt a cybersecurity awareness and accountability culture.awareness and accountability at all organizational levels is essential for long-term resilience.

The future of the Philippine airline industry is inextricably linked to its ability to adapt to emerging cybersecurity challenges. AI-driven cyberattacks, leveraging machine learning to exploit system vulnerabilities, represent a growing concern. Airlines must invest in advanced technologies, such as artificial intelligence and machine learning, to proactively detect and mitigate threats.

Blockchain technology holds promise for enhancing the security of ticketing and payment systems, ensuring the integrity of transactions and reducing fraud. Smart airports, equipped with IoT-enabled systems, offer increased efficiency but require robust cybersecurity measures to protect interconnected devices. Regional cooperation through ASEAN-led initiatives will be crucial in addressing shared threats and fostering a collective defense against cyberattacks.

By prioritizing cybersecurity, Philippine airlines can safeguard their operations, protect passenger trust, and ensure sustainable growth in the digital age.