Thai Airways says 60,529 passenger booking records exposed in Amadeus breach

BANGKOK — 10 November 2026, Thai Airways International has disclosed that approximately 60,529 passenger booking records were accessed without authorisation in a security breach involving Amadeus IT Group S.A., its reservation and passenger service provider.

In a statement, the airline said it had been notified by Amadeus of a security incident involving unauthorised access to passenger reservation data stored in Amadeus’ systems between 10 August 2023 and 23 September 2026.

The investigation found that approximately 60,529 passenger records had been accessed, including passengers’ names, booking reference numbers (PNRs), travel dates, flight routes and travel classes.

An additional 376 passenger records may also have been affected. Besides the information listed above, these records may have included email addresses, phone numbers, passport numbers, nationalities, frequent flyer membership numbers, flight numbers, ticket numbers, seat numbers and other related details.

However, Thai Airways stressed that passengers’ credit card details remained securely stored and were not affected by the incident.

Amadeus confirmed that user accounts involved in the unauthorised access had been disabled and all affected passwords had been changed. The company has also strengthened its monitoring and surveillance systems to prevent similar incidents from happening again.

Thai Airways emphasised that the incident did not affect its own systems or operations.

The airline said it takes the protection of personal data extremely seriously and had reported the incident to the relevant authorities.

It is currently reviewing and analysing the information provided by Amadeus in detail. Passengers whose information is confirmed to have been affected will be notified individually once the relevant details have been verified.

Thai Airways apologised for any concern and inconvenience caused by the incident.