Singapore Airlines says 46,000 booking records hit following Amadeus breach

Singapore Airlines confirms customer data exposure through a breach at travel technology provider Amadeus Stolen booking records included passenger details, itineraries, and limited passport and loyalty-program information Multiple major airlines were affected, raising phishing and identity-fraud co

<![CDATA[ <article> <ul><li><strong>Singapore Airlines confirms customer data exposure through a breach at travel technology provider Amadeus</strong></li><li><strong>Stolen booking records included passenger details, itineraries, and limited passport and loyalty-program information</strong></li><li><strong>Multiple major airlines were affected, raising phishing and identity-fraud concerns for travelers</strong></li></ul><p>Singapore Airlines has become the latest in the seemingly growing list of airlines affected by a breach at a third-party technology provider.</p><p>Amadeus, a Spanish technology company that airlines and airports use to manage reservations, bookings, and overall passenger management, recently issued a brief statement saying it “became aware of a vulnerability affecting a travel booking display environment.” </p><p>In the announcement, Amadeus said certain booking-display data was accessible to the attackers but stressed that there was no evidence of payment or financial data being accessed. </p><p>“There are no indications that this vulnerability has been exploited for ransomware purposes,” the company said, adding that it “implemented measures to fix the vulnerability as well as enhanced monitoring and detection capabilities.”</p><p>In the meantime, numerous airlines started reporting sensitive data compromise as a result of this breach.</p><h2 id="cathay-pacific-japan-airlines-and-more">Cathay Pacific, Japan Airlines, and more</h2><p>Hong Kong’s flagship international airline, Cathay Pacific, issued a statement saying Amadeus notified it about a breach and “unauthorized access to travel reservation data” by a threat actor that used login credentials assigned to a system account. </p><p>Amadeus then told Cathay Pacific around 53,000 bookings were affected, and that the exposure took place between August 2023 and September 2026. “In the majority of cases, the information accessed included booking reference, passenger name, and flight details,” the airline said, adding that in a “smaller subset of cases”, additional data such as email and phone contacts, travel documents and/or frequent flyer numbers were also exposed. </p><p>The same day, Japan Airlines and Japan Transocean Air both shared similar news, saying a “portion of customer reservation data” had been accessed by an unauthorized third party. </p><p>Japan Airlines said some 92,000 customers were affected, including approximately 2,000 of those whose passport numbers were also exposed. All Nippon Airways said 37,800 of its customers were affected, including around 1,700 with additional data exposure. Korean Air, Asiana Airlines, and Malaysia Airlines, all confirmed being affected by the Amadeus incident, while Qantas said it was still investigating. </p><h2 id="launching-phishing-attacks">Launching phishing attacks</h2><p>We can now add Singapore Airlines to that list, with 46,000 records of its own. These include customers' names, booking reference numbers, travel ​itineraries and booking classes and, in a smaller number of cases (around 620 booking records), email addresses, phone numbers, travel document details, and KrisFlyer membership numbers.</p><p>According to <a href="https://www.reuters.com/world/asia-pacific/singapore-airlines-says-46000-booking-records-affected-by-amadeus-breach-2026-11-04/" target="_blank"><em>Reuters</em></a>, Singapore Airlines is now reaching out to affected customers with upcoming travel plans to change their booking reference numbers as a precaution. The ⁠airline also confirmed that its IT systems were not breached.</p><p>So far, there is no indication that the stolen data ended up on the dark web, and no threat actors claimed responsibility for the breach, just yet. There is a possibility that the culprits will try to extort the airlines for money, in exchange for deleting the stolen information.</p><p>This is the kind of data cybercriminals enjoy most. It allows them to launch highly personalized phishing emails that appear to come from the airlines themselves, referencing genuine booking details, flight dates, destinations and passenger names. </p><p>They could use this kind of information to trick unsuspecting travelers into clicking malicious links, sharing login credentials, or making fraudulent payments for supposed booking changes, refunds, or additional fees. </p><p>What’s more, the exposed passport details and frequent flyer numbers can also help criminals impersonate customers, try to take over people’s accounts, or launch identity fraud attacks against the airlines themselves. Even without financial information, simply by combining seemingly harmless travel details, cybercriminals can create enough context to make their scams considerably more convincing, and thus more difficult to detect and prevent.</p> </article> ]]>