The Breach Behind Your Airline Booking Wasn’t at Your Airline

A widening list of airlines is warning passengers that their booking details may have been seen by people who should not have seen them, and the common thread is not any one carrier. It is Amadeus, the reservation technology company that stores and processes bookings for airlines around the world. SAS says 350,164 people are affected and has reported the incident to Sweden’s privacy regulator. Finnair puts its figure at about 116,000 reservations, and Thai Airways has identified 60,529 potentially affected passenger records.

Those are only the latest disclosures. Warnings began in late October, when Japan Airlines reported about 92,000 affected customers, ANA 37,800 and Cathay Pacific roughly 53,000 bookings. Singapore Airlines disclosed around 46,000 records on November 3, and Malaysia Airlines and Bangkok Airways have also issued alerts. Norwegian broadcaster NRK reported that Norwegian Air passengers are among those affected. The reported window runs from August 2023 to September 2026, though airlines note that this does not by itself show continuous unauthorised access for that whole period.

What was exposed varies. Most affected records hold names, booking references and flight details, and SAS says its cases mainly involve older bookings and completed trips. Smaller groups of records may also include passport numbers, contact details or frequent-flyer numbers. Cathay Pacific said the intruder used credentials assigned to an Amadeus system account, and Amadeus has said it fixed a vulnerability in a booking-display environment and found no evidence that payment data was accessed. Singapore Airlines says no bookings were altered.

The practical risk is less about cancelled flights than about convincing scams, since a fraudster who knows your name, route and booking code can sound very official. Check your airline’s own security notice even if you have not received an email, confirm upcoming trips directly in the airline’s app or website, and use any replacement booking reference your airline issues. Finnair, for example, has reissued codes for a small number of active bookings. Treat any unexpected request for passport scans, payments or passwords as suspect, and verify it independently rather than through an emailed link.

Sources: The Local, TravelWise