Thai Airways says 60,529 passenger records exposed via Amadeus; Finnair 116,000; Amadeus gives no total
Airlines are reissuing booking references and answering regulators while Madrid-listed Amadeus, the data controller, has put no number on the exposure. Its third-quarter revenue of €1.74 billion landed on November 6 with the incident unquantified.
Vincent Jiangtwo-minute read
Thai Airways said on November 10 that about 60,529 passenger booking records were accessed without authorization through Amadeus+1.10% — Amadeus, up 1.10 percent today, its reservation and passenger-service provider, over a window running from August 10, 2023, to September 23, 2026 1. A further 376 records may have carried passport numbers, email addresses and phone numbers 1. The airline says no card data was exposed and its own systems were untouched 1.
The count is bookings, not confirmed unique passengers 2, and the three-year window matches what every affected carrier reports 3. Thailand's Transport Ministry has ordered aviation agencies and database holders to tighten cybersecurity, and the Civil Aviation Authority of Thailand named six other affected airlines 4.
One platform, two explanations
Amadeus, the Spanish travel-technology company, went public with the incident in October; Qantas says it was told the issue was contained in September 5. The company runs the world's largest travel reservation system 6 and reported more than $6.5 billion of revenue last year 7.
It says a vulnerability in a booking display environment made certain data accessible, that it has found no evidence payment data was taken or ransomware used, and it has declined to say how many total victims were affected 7. Its airline customers describe a sharper mechanism: an intruder using login credentials assigned to an Amadeus system account 7. At least 15 carriers are confirmed affected or investigating 3.
Six flag carriers now count 405,329 records exposed through Amadeus
Finnair and Thai Airways, disclosed within two days, are the two largest
Data
| Value | |
|---|---|
| Finnair | 116,000 |
| Japan Airlines | 92,000 |
| Thai Airways | 60,529 |
| Cathay Pacific | 53,000 |
| Singapore Airlines | 46,000 |
| ANA | 37,800 |
Airlines do the cleanup, Amadeus holds the liability
Finnair, Finland's flag carrier, put its exposure at about 116,000 bookings on November 9 and says Amadeus is the data controller for the affected service, has notified an EU data protection authority under the GDPR, and is responsible for informing affected passengers 8. "We are demanding a detailed clarification from Amadeus on this incident," said Timo Arndal, Finnair's chief information security officer 8. Singapore Airlines is already reissuing booking references to passengers with upcoming trips 3.
The bill has no number on it
On November 6 Amadeus reported third-quarter revenue of €1,740.7 million and net income of €381.8 million 9, and reiterated 2026 guidance at the low end of its range 6. The results release led with growth and AI partnerships, not the breach 10.
No disclosure from Amadeus or any airline has yet put a euro figure on remediation, notification or regulatory exposure, and no source quantifies renewal risk or fines. "No evidence of misuse" is not a clean audit. The next tells are Finnair's demanded clarification and any carrier that prices its cleanup. If airline IT contracts start repricing security, the platform that concentrated the risk pays for it.
Get Security by email, free
The breaches, flaws and security vendors AI is putting to the test. In our daily email, every weekday.
