Thai Airways discloses 60,529 records exposed through Amadeus

Thai Airways has disclosed that about 60,529 passenger booking records may have been accessed without authorisation through systems operated by travel technology provider Amadeus, although passengers’ credit card details were not affected.

The airline said on Monday that the security incident involved reservation information held by Amadeus between 10 August 2023 and 23 September 2026, spanning more than three years. Its investigation is continuing, and it has pledged to notify potentially affected passengers individually once the relevant information has been verified.

The potentially exposed records included passengers’ names, booking reference numbers, travel dates, flight routes and cabin classes. A smaller group of approximately 376 records may additionally have contained more sensitive personal information, including passport numbers, contact details and frequent flyer membership numbers.

Thai Airways said it had found no evidence, as of its 9 November announcement, that the affected information had been publicly disclosed. It also emphasised that the incident took place within its supplier’s systems and had not disrupted the airline’s own information technology infrastructure or flight operations.

Amadeus confirmed that the credentials used for unauthorised access had been revoked and affected passwords reset. Monitoring and detection measures have also been strengthened. The airline said it had informed the relevant authorities and was examining the material supplied by Amadeus to establish precisely which customers and data fields were involved.

The company did not say when it first learned of the problem or whether the access was continuous throughout the stated period. The dates describe the records covered by the security investigation, not necessarily individual intrusions on every day.

The airline’s disclosure adds to a widening series of notifications from carriers using Amadeus technology. The Spanish travel systems provider acknowledged in an October statement that it had identified a vulnerability affecting a travel booking display environment, through which certain booking information could be accessed.

Amadeus said its investigation was continuing but that there was no evidence of payment or financial data being accessed. It also said there were no indications of the vulnerability being exploited for ransomware, and that it had taken steps to repair the weakness while remaining in contact with airline customers and authorities.

Cathay Pacific disclosed on 30 October that around 53,000 bookings had been affected by unauthorised access to data in Amadeus systems between August 2023 and September 2026. It said an unauthorised party had used login credentials assigned to an Amadeus system account, according to information provided by the technology company.

The Hong Kong airline said most affected records involved booking references, passenger names and flight details, while a smaller proportion might have included contact information, travel document particulars and frequent flyer numbers. Cathay said it had received an initial notification on 28 October and further information the following day.

Singapore Airlines subsequently disclosed that approximately 46,000 booking records had been accessed through the same provider. Of those, about 620 records might also have contained email addresses, telephone numbers, travel document information and loyalty programme identifiers. It said neither financial information nor its own internal systems had been compromised.

Other airlines, including Japan Airlines and All Nippon Airways, have also identified affected customer reservations. The incident affected airlines without breaching their individual systems.

The separate airline disclosures have not established a single industry-wide total of affected passengers. Booking records and unique customers are not necessarily interchangeable measures, and the airlines have described their findings using different categories.

For Thai Airways passengers, the central unresolved issue is the extent to which identifying details were viewed and whether any of those details were subsequently used. The airline has not identified a perpetrator in its announcement, nor has it specified how many individual passengers correspond to the affected records.

Booking references combined with names and itineraries can be sensitive because they reveal details of journeys. However, access to reservation information does not, by itself, establish that travel arrangements were altered or that identity information was misused. Thai Airways has made no such finding in its disclosure.

The company said additional information potentially involved in the smaller group of records included nationality, flight numbers, ticket numbers and seat assignments, alongside email addresses, telephone numbers, passport particulars and frequent flyer identifiers.

Thai Airways apologised to passengers for the concern and inconvenience caused and said direct notifications would follow completion of its review of the Amadeus data.