Singapore Airlines said on Tuesday 3 November that about 46,000 of its booking records were accessed in a data breach at Amadeus, the Spanish company that provides its reservation technology12. The exposed data covers passenger names, booking reference numbers, itineraries and booking classes. For about 620 records, email addresses, phone numbers, travel document details and KrisFlyer numbers may also have been accessed13. According to Amadeus, no bank account or credit card details were exposed and no bookings were changed1.

What was exposed for Singapore Airlines passengers

The data came from booking records, also known as PNRs, which hold the booking reference, the passenger name and the flights41. Singapore Airlines says its own IT systems were not breached and that the incident was confined to the Amadeus platform23. As a precaution, the airline is contacting affected customers with upcoming travel and changing their booking reference numbers. It has informed the relevant authorities3. Singapore's Personal Data Protection Commission said on 4 November that it was aware of the incident and was investigating, according to The Straits Times5.

When the breach was found and reported

In a statement published in October, Amadeus said it had become aware of a vulnerability affecting a travel booking display environment, through which certain booking display data was accessible. It said there was no evidence that payment or financial data had been accessed and no indication that the vulnerability had been exploited for ransomware. Amadeus says it has fixed the vulnerability and enhanced its monitoring and detection6. The company told heise online that it was alerted to the potential vulnerability on 21 September7.

Japan Airlines says the unauthorised access ran from 10 August 2023 to 23 September 20264. The airlines learned of it in late October: Japan Airlines was notified on 23 October and Cathay Pacific on 28 October48. Cathay Pacific says an unauthorised party used login credentials assigned to an Amadeus system account, and that Amadeus has since carried out a password reset8.

Which other airlines are affected

Cathay Pacific puts its figure at about 53,000 bookings8, and Hong Kong's privacy commissioner has received Cathay Pacific's breach notification and opened an investigation9. Japan Airlines and its subsidiary Japan Transocean Air report about 92,000 customers, of whom about 2,000 also had details such as passport numbers and email addresses exposed4. ANA reports 37,800 affected customers, about 1,700 of them with passport or contact details10. Korean Air and Asiana Airlines have reported unauthorised access to booking data held by Amadeus without giving totals1112. Malaysia Airlines says some customer information may have been affected13, and Condor confirmed to aeroTELEGRAPH that its records are involved, without giving a number14. Qantas is still assessing whether its bookings were affected10.

The figures cannot simply be added up, because Cathay Pacific counts bookings while the Japanese airlines count customers12. Amadeus has not said how many customers or airlines were affected in total112.

Does it affect flight operations?

No airline has reported an operational impact15. Japan Airlines says flight operations are unaffected4, and Cathay Pacific says the incident has not affected its systems or operations8. No airline has reported a breach of its own internal systems; the exposure was traced to an Amadeus platform15. Japan Airlines uses the Amadeus passenger service system for reservations, ticketing and check-in4, and Amadeus says more than 130 customers use its Altéa software12.

What passengers should watch for

Airlines are warning customers about phishing. With a name, a flight date and a booking reference, a scammer can send a convincing fake airline email asking for payment or pointing to a fraudulent website12. Japan Airlines has warned customers about deceptive emails, calls and websites12, and Malaysia Airlines asks customers to stay alert to unsolicited messages requesting personal or financial information13. Open Jaw advises travel advisors whose clients flew with affected airlines between August 2023 and September 2026 to watch for new booking references, and warns that travellers whose passport or travel document details were exposed should be extra careful with unexpected messages15. Passwords and credit card numbers were not compromised, according to Japan Airlines4. Crews asked about the breach can point out that Singapore Airlines is contacting affected customers with upcoming travel1, and that Cathay Pacific will notify affected customers individually once it has established the details8.