--- title: "Thai Airways says 60,529 passenger records exposed via Amadeus; Finnair 116,000; Amadeus gives no total" description: "Airlines are reissuing booking references and answering regulators while Madrid-listed Amadeus, the data controller, has put no number on the exposure. Its third-quarter revenue of €1.74 billion landed on November 6 with the incident unquantified." publisher: "The Inference" section: "Security" published: 2026-11-11T20:04:29.998Z modified: 2026-11-11T20:04:29.998Z canonical: https://theinference.org/article/thai-airways-says-60-529-passenger-records-exposed-via-amadeus-finnair-116-000-amadeus-gives-no-total language: en keywords: "Cybersecurity, Data Breach, Airlines, Travel Technology, Privacy" --- # Thai Airways says 60,529 passenger records exposed via Amadeus; Finnair 116,000; Amadeus gives no total > Airlines are reissuing booking references and answering regulators while Madrid-listed Amadeus, the data controller, has put no number on the exposure. Its third-quarter revenue of €1.74 billion landed on November 6 with the incident unquantified. Thai Airways [said on November 10](https://www.khaosodenglish.com/featured/2026/11/10/thai-airways-says-60529-passenger-booking-records-exposed-in-amadeus-breach/) that about 60,529 passenger booking records were accessed without authorization through [Amadeus](https://theinference.org/markets/companies/amadeus-it-group), its reservation and passenger-service provider, over a window running from August 10, 2023, to September 23, 2026 [1]. A further 376 records may have carried passport numbers, email addresses and phone numbers [1]. The airline says no card data was exposed and its own systems were untouched [1]. The count is bookings, not confirmed unique passengers [2], and the three-year window matches what every affected carrier reports [3]. Thailand's Transport Ministry has ordered aviation agencies and database holders to tighten cybersecurity, and the Civil Aviation Authority of Thailand [named six other affected airlines](https://www.straitstimes.com/asia/se-asia/thailand-orders-tighter-aviation-cyber-security-after-data-breaches-across-asia) [4]. ## One platform, two explanations Amadeus, the Spanish travel-technology company, went public with the incident in October; Qantas says it was told the issue was contained in September [5]. The company runs the world's largest travel reservation system [6] and [reported more than $6.5 billion of revenue last year](https://www.marketscreener.com/news/amadeus-meets-earnings-expectations-and-reiterates-2026-guidance-at-the-low-end-of-the-range-ce785fddd188f121) [7]. It says a vulnerability in a booking display environment made certain data accessible, that it has found no evidence payment data was taken or ransomware used, and it has declined to say how many total victims were affected [7]. Its airline customers describe a sharper mechanism: an intruder using login credentials assigned to an Amadeus system account [7]. [At least 15 carriers are confirmed affected or investigating](https://thecyberexpress.com/amadeus-cybersecurity-incident/) [3]. *Chart: **Six flag carriers now count 405,329 records exposed through Amadeus** Bar chart of disclosed Amadeus exposure by airline: Finnair 116,000 bookings, Japan Airlines 92,000 customers, Thai Airways 60,529 records, Cathay Pacific 53,000, Singapore Airlines 46,000, ANA 37,800.* *Records each airline says were accessed in Amadeus systems between August 2023 and September 2026. Finnair reports bookings, Japan Airlines reports customers, ANA reports customer profiles. Sources: airline disclosures as reported by Khaosod English, The Cyber Express and Aviacionline. [1][3][8]* ## Airlines do the cleanup, Amadeus holds the liability Finnair, Finland's flag carrier, [put its exposure at about 116,000 bookings on November 9](https://www.aviacionline.com/english/commercial-aviation/europe/finnair-confirms-amadeus-data-breach-exposed-around-116-000-of-its-bookings_a6af1fc0f4622b038fccd9ad0) and says Amadeus is the data controller for the affected service, has notified an EU data protection authority under the GDPR, and is responsible for informing affected passengers [8]. "We are demanding a detailed clarification from Amadeus on this incident," said Timo Arndal, Finnair's chief information security officer [8]. Singapore Airlines is already reissuing booking references to passengers with upcoming trips [3]. ## The bill has no number on it On November 6 Amadeus reported [third-quarter revenue of €1,740.7 million and net income of €381.8 million](https://amadeus.com/en/investors) [9], and reiterated 2026 guidance at the low end of its range [6]. The results release led with growth and AI partnerships, not the breach [10]. No disclosure from Amadeus or any airline has yet put a euro figure on remediation, notification or regulatory exposure, and no source quantifies renewal risk or fines. "No evidence of misuse" is not a clean audit. The next tells are Finnair's demanded clarification and any carrier that prices its cleanup. If airline IT contracts start repricing security, the platform that concentrated the risk pays for it. ## Takeaway Six flag carriers have disclosed 405,329 exposed records through Amadeus, but the Madrid-listed platform, the data controller, still puts no number on the breach. ## Sources 1. [Khaosod English, "Thai Airways says 60,529 passenger booking records exposed in Amadeus breach", 10 November 2026](https://www.khaosodenglish.com/featured/2026/11/10/thai-airways-says-60529-passenger-booking-records-exposed-in-amadeus-breach/) 2. [FTNnews, "Thai Airways Reveals Data Breach Affecting 60,529 Bookings", 10 November 2026](https://ftnnews.com/travel-news/aviation/thai-airways-data-breach-60529-bookings/) 3. [The Cyber Express, "Amadeus Cybersecurity Incident Exposes Data at 15 Airlines", 7 November 2026](https://thecyberexpress.com/amadeus-cybersecurity-incident/) 4. [The Straits Times, "Thailand orders tighter aviation cyber security after data breaches across Asia", 11 November 2026](https://www.straitstimes.com/asia/se-asia/thailand-orders-tighter-aviation-cyber-security-after-data-breaches-across-asia) 5. [teiss, "Qantas customer data exposed in cyber attack on reservation provider", 5 November 2026](https://www.teiss.co.uk/news/qantas-customer-data-exposed-in-cyber-attack-on-reservation-provider-18420) 6. [The Record from Recorded Future News, "More Asian airlines announce data breaches after attack on Spanish IT provider Amadeus", 4 November 2026](https://therecord.media/asian-airlines-announce-data-breach-it-provider-incident) 7. [Reuters via MarketScreener, "Amadeus meets earnings expectations and reiterates 2026 guidance at the low end of the range", 6 November 2026](https://www.marketscreener.com/news/amadeus-meets-earnings-expectations-and-reiterates-2026-guidance-at-the-low-end-of-the-range-ce785fddd188f121) 8. [Aviacionline, "Finnair confirms Amadeus data breach exposed around 116,000 of its bookings", 9 November 2026](https://www.aviacionline.com/english/commercial-aviation/europe/finnair-confirms-amadeus-data-breach-exposed-around-116-000-of-its-bookings_a6af1fc0f4622b038fccd9ad0) 9. [Yahoo Finance (Simply Wall St), "How Strong Earnings Will Impact Amadeus Shares Investors", 7 November 2026](https://finance.yahoo.com/markets/stocks/articles/strong-earnings-impact-amadeus-shares-211558139.html) 10. [Amadeus Investor Relations, results and financial highlights page, accessed 11 November 2026](https://amadeus.com/en/investors) --- Thai Airways says 60,529 passenger records exposed via Amadeus; Finnair 116,000; Amadeus gives no total — The Inference. Canonical: https://theinference.org/article/thai-airways-says-60-529-passenger-records-exposed-via-amadeus-finnair-116-000-amadeus-gives-no-total