If you’ve posted anything at all that contains your PNR, and your surname is either visible or part of your social media account name/handle they have everything they need to access your booking and call you up with the details any of you can see on MMB.

Assuming this isn’t the case, and I am FOREVER reminding friends not to post their bloody boarding cards online, it does indeed need reporting as their is a data breech.

If you post a PNR inadvertently any scammer can cancel your booking, or pose as BA, who will only ever email you and never phone you up out of the blue over such instances.