An Intruder Read Airline Bookings Inside Amadeus for Three Years, and the List of Hit Airlines Keeps Growing

For roughly three years, someone with a valid login was reading airline reservations inside Amadeus, the Spanish company whose software books and tickets flights for hundreds of carriers. The list of airlines affected keeps growing. On Monday, Thai Airways and Finnair became the latest to tell passengers their bookings were exposed.

THAI said the unauthorized access to booking data ran from August 10, 2023 to September 23, 2026, and that about 60,529 of its passenger records may have been viewed. Those records hold names, booking references, travel dates, routes and cabin class. A few hundred more may also include email addresses, phone numbers, passport numbers, nationality and frequent flyer numbers.

Thousands of bookings per airline

Finnair said about 116,000 of its reservations sat in flight lists covered by the breach, and that roughly 750 of them were actually opened. It has issued new booking numbers for the active ones so nobody can use the old codes to get into a trip.

The Asian carriers went first. Cathay Pacific was notified on October 28 and says about 53,000 bookings were affected, accessed by an intruder "using login credentials assigned to its system account." Japan Airlines put its count at about 90,000 customers and All Nippon Airways at 37,800, with passports and contact details exposed for a smaller group at each. Singapore Airlines, Korean Air, Asiana and Malaysia Airlines have also reported exposure, and Qantas is still working out whether its bookings were hit.

What Amadeus says

Amadeus has described the problem as a vulnerability in a travel booking display environment. A spokesperson told The Record there is no evidence payment or financial data was accessed and no sign of ransomware. The company has reset the affected passwords, revoked the credentials and added monitoring. It has not said how many airlines or passengers are involved in total, or whether the attackers have been in touch.

The length of the access is the striking part. A system account quietly reading booking records for more than three years is the kind of third party exposure that never touches the airlines' own networks, which is exactly what each of them has been quick to point out. It echoes the recent theft at French bank Crédit Mutuel Arkéa, where attackers went through a service provider's platform rather than the bank itself.

For passengers, the immediate risk is phishing. A real booking reference, a name and a route are enough to make a fake rebooking or refund email look convincing. Singapore Airlines has warned customers to be wary of malicious emails and is contacting people with upcoming flights to change their exposed booking numbers.

Some offers on this page may be paid placements or contain affiliate links.