Amadeus data breach exposes 46,000 bookings at world's best airline

About 46,000 Singapore Airlines (SIA) booking records were accessed in a data breach at Amadeus, a software provider that supports some of the carrier's reservation processes.

In a media statement on Nov. 3, SIA said the data accessed included customers' names, booking reference numbers, travel itineraries and booking classes, CNA reported.

For about 620 of the records, email addresses, phone numbers, travel document details and KrisFlyer membership numbers may also have been accessed, the airline said.

SIA said the unauthorized third-party access involved customer data held on Amadeus's platform and that its own IT systems were not breached.

Amadeus has confirmed that no bank account or credit card information was exposed and that no bookings were changed, according to SIA. The provider has also put in place containment measures and additional security safeguards, the airline said.

SIA said it is contacting affected customers with upcoming travel to change their booking reference numbers. It has informed the relevant authorities and apologized to affected customers for any inconvenience caused.

"The protection of our customers' personal data is of utmost importance to SIA," it added.

Singapore's Personal Data Protection Commission said Nov. 4 it is aware of the incident and is investigating the case, The Straits Times reported.

A Singapore Airlines Airbus A380 lands at Sydney Airport. Photo by Unsplash/Troy Mortier

Malaysia Airlines, Cathay Pacific Airways, Japan Airlines, Korean Air and Asiana Airlines have also reported customer data compromised in the Amadeus breach. The airlines have said the breach may have affected information processed between August 2023 and September 2026.

Cathay Pacific has put the number of its affected bookings at about 53,000 and said the unauthorized party used login credentials assigned to an Amadeus system account. Japan Airlines has reported about 92,000 affected customers, including those of its subsidiary Japan Transocean Air.

Amadeus, a Spain-based travel technology company, said in an October statement that it had become aware of "a vulnerability affecting a travel booking display environment."

It said it had fixed the vulnerability and strengthened monitoring and detection, and that while its investigations continue, there is no evidence that payment or financial data was accessed.

Skytrax named SIA the world's best airline at its World Airline Awards in London on Sept. 18, the carrier's sixth win of the title.

The Amadeus incident is the third data breach to affect SIA since February 2021, according to The Straits Times. That month, 580,000 members of its KrisFlyer and PPS programs had their membership numbers, tier status and in some cases names compromised in a breach at air transport IT firm SITA.

In 2022, a phishing attack on SIA's in-flight retailer KrisShop exposed the data of 4,749 customers, including the bank account numbers of about 165 of them.