More Airlines Warn Passengers Over Booking Data Leak
More airlines are warning customers that their booking details may have been accessed in a security incident involving Amadeus, which handles reservation data for carriers. On 9 November, Finnair reported about 116,000 reservations involved, while Thai Airways identified 60,529 potentially affected passenger records. Finnair said around 750 of its bookings had been opened for examination. Airlines have begun contacting affected customers.
Airline warnings began in late October. Japan Airlines reported about 92,000 affected customers, ANA 37,800 and Cathay Pacific roughly 53,000 bookings. Singapore Airlines disclosed around 46,000 affected booking records on 3 November, while Malaysia Airlines and Bangkok Airways also issued alerts. The reported period runs from 10 August 2023 to 23 September 2026, but this does not establish continuous unauthorised access.
Most affected records contain names, booking codes and flight details; smaller groups may also include passport numbers, contact details and frequent-flyer identifiers. Cathay Pacific said an intruder used credentials assigned to an Amadeus system account. Separately, Amadeus said it had fixed a vulnerability in a booking-display environment and found no evidence of access to payment data. Whether those descriptions concern the same technical weakness remains unclear.
How to Protect Your Airline Booking
- Airline notice: Check your carrier's official security update, even if you have not received an email.
- Upcoming flight: Confirm your itinerary on the airline's website or app.
- Reference number: Use a replacement code if your airline issues one.
- Personal data: Ask Amadeus at dataprotection@amadeus.com whether your details were involved.
- Scam warning: Ignore unexpected requests for passport scans, payments or passwords.
The breach does not, by itself, mean a flight has been cancelled or a reservation changed. Singapore Airlines said no bookings were altered by the intrusion. Finnair replaced reference numbers for a small number of active reservations that had been examined. Anyone receiving a new code should use it to manage their journey, but verify the change independently through their airline, not an email link.