Thai Airways Data Breach: Thailand's PDPC Orders a Forensic Report, CAAT Tells Airline to Notify Passengers

Two Thai regulators have stepped in over the Thai Airways (THAI) passenger data exposed through Amadeus, after the airline disclosed on 9 November 60,529 booking records accessed through its reservation provider. The Office of the Personal Data Protection Committee (PDPC) has told THAI to send more information on three points, among them a forensic report on the root cause, and the Civil Aviation Authority of Thailand (CAAT) wants the airline to notify data owners individually and quickly. Neither has set a date or announced a penalty.

What the PDPC wants

THAI reported the breach to the data protection office within the 72 hours Thailand's Personal Data Protection Act allows. After reading that first report, the office asked on 11 November for three things, Posttoday and Thansettakij report:

• the results of an electronic examination that establishes the root cause;
• proof that affected passengers were told, with the steps they can take to protect themselves;
• a review and upgrade of THAI's data security so the same thing can't happen again.

The office requires THAI to report back "as soon as possible".

Its announcement puts the number of passengers whose booking data was accessed at 65,029, which doesn't match THAI's own 60,529. Neither the office nor the airline has explained the difference.

The aviation regulator's order

CAAT, which issued its statement on the evening of 10 November, told THAI to take measures to care for and protect affected passengers appropriately. It uses THAI's figure of 60,529 passenger records covering travel from 2023 onwards, and says the incident did not affect flight safety or the airline's services. CAAT says it will monitor THAI's data protection and cybersecurity measures as the case develops.

THAI's last statement

The airline's 9 November notice says credit card data was not affected and that passengers will hear from THAI directly once the details are verified.