My guess is something related to looking up Frontier flight status was abused to enumerate all active flight itineraries.

If Frontier had been completely breached and all data compromised, there's likely more lucrative things the attacker can do than just using the data to enhance their credit card stealing phishing attack.