Thai Airways Amadeus Data Breach: 60,529 Passenger Booking Records Accessed, Card Data Not Affected
Thai Airways Amadeus data breach: about 60,529 passenger booking records were accessed through the reservation provider Amadeus, and 376 may include passport numbers. Card data wasn't hit.
About 60,529 Thai Airways International (THAI) passenger booking records were accessed without authorisation through Amadeus, the airline's reservation system provider, THAI said in a statement on 9 November. InfoQuest reports that the records hold passenger names, booking references (PNRs), travel dates, routes and ticket class, and that roughly 376 records may carry more: email addresses, phone numbers, passport numbers, nationality, frequent flyer numbers and seat details. Credit card data was not affected, the airline says.
Two other Southeast Asian carriers have reported exposure through Amadeus: Malaysia Airlines, which gave no count, and Singapore Airlines, with about 46,000 booking records.
Three years of bookings
The unauthorised access covers bookings between 10 August 2023 and 23 September 2026. THAI says the breach didn't affect its own systems or operations, since it happened inside Amadeus's infrastructure. Bangkokbiznews adds that THAI has found no evidence the data has been disclosed.
According to THAI, Amadeus has revoked the user accounts used for the access, reset every affected password and stepped up monitoring. The airline says it has reported the incident to the relevant agencies but hasn't named them.
Two accounts of how it happened
Amadeus's own statement blames a "vulnerability affecting a travel booking display environment" and names no airlines. Cathay Pacific described it differently: the New Straits Times reports the airline said the access used "login credentials assigned to an Amadeus system account".
The same report puts Cathay Pacific's exposure at about 53,000 bookings and lists Japan Airlines, ANA, Korean Air and Asiana among the other affected airlines.
What passengers are told
THAI hasn't published advice for passengers; it says it will notify affected passengers individually once the details have been verified.
More news
SPH Media Data Breach: Attacks on Five Systems Expose About 9% of the Customer Database
SPH Media data breach: attacks on five systems between 4 and 8 November exposed about 9% of the Singapore publisher's customer database, mostly email addresses. No card data was taken.
Data Breach Notices From 10 Philippine Agencies, BIR and SEC Among Them, Reach the Privacy Commission
Data breach notifications from 10 Philippine government agencies, the BIR and SEC among them, have reached the National Privacy Commission, which is now reviewing each case.
Indonesia Financial Sector Malware Attacks: Parliament to Summon BSSN, Hirudo Trojan Swaps Bank Apps
Indonesia financial sector malware attacks: the Hirudo trojan swaps bank apps for patched copies, threat-map counts hit 1.2 million a day and parliament will summon BSSN.