Thailand tightens aviation cybersecurity after 60,000 passenger data breach

Thailand has ordered aviation agencies and service providers holding personal data to strengthen cybersecurity following a series of data breaches involving airlines across Asia, including Thai Airways.

The National Cyber Security Agency is monitoring potential threats and working to prevent unauthorized access.

The government is preparing a coordinated response involving the National Security Council and cybersecurity authorities, with investigations and legal action planned against those responsible for unlawfully accessing personal information.

The measures follow Thai Airways' announcement on Nov. 9 that some 60,529 passenger booking records may have been accessed without authorization through the system of Amadeus IT Group, its reservation and passenger-service technology provider.

A Thai Airways aircraft at an airport. Photo by Pexels

The airline said the incident did not affect its own systems or flight operations, or passengers' credit card and financial information.

However, the potentially accessed booking records contained a range of personal and travel details, including passengers' names, booking reference numbers, travel dates, flight routes and cabin classes, according to Thai Airways.

Around 376 passenger records may have contained additional personal information, including email addresses, telephone numbers, passport numbers, and nationalities, it said.

Six other airlines reported similar incidents involving Amadeus: All Nippon Airways and Japan Airlines of Japan, Asiana Airlines of South Korea, Cathay Pacific of Hong Kong, Malaysia Airlines, and Singapore Airlines.

The hacked booking data was stored by Amadeus between Aug. 10, 2023, and Sept. 23, 2026.

Thai Airways said it has found no evidence that the stolen information has been made public.

To prevent further unauthorized access, Amadeus said it has disabled the login credentials used in the incident, reset the passwords of affected accounts, and strengthened its security monitoring systems.

The Civil Aviation Authority of Thailand has instructed Thai Airways to contact affected passengers and advise them to change their login passwords and take steps to protect their booking information, The Straits Times reported. The airline said it would notify the passengers individually.

Thai Airways is continuing its investigation and reviewing information provided by Amadeus.