About 46,000 Singapore Airlines flight booking records were accessed without authorisation following a cyber security incident at a third-party service provider, potentially exposing some customers’ personal data.
Responding to queries from Lianhe Zaobao on Tuesday (3 November), SIA confirmed that some of its customers’ data stored on travel technology company Amadeus’s platform had been accessed without authorisation. Amadeus provides technical support for some of SIA’s booking processes.
According to information provided by Amadeus, data relating to about 46,000 SIA flight booking records was accessed without authorisation. This included customers’ names, booking references, itineraries and cabin classes.
Customer email addresses, telephone numbers, travel document details and KrisFlyer frequent flyer membership numbers in about 620 of these booking records may also have been accessed.
However, Amadeus confirmed that the exposed information did not include bank account or credit card details, and that no flight booking records had been altered in the incident. As a precaution, SIA is contacting affected customers directly to change their booking references.
SIA stressed that its own information technology systems had not been breached and that the cyber security incident was confined to Amadeus’s platform. Amadeus told SIA that it had taken containment measures and put additional safeguards in place.
SIA apologised to affected passengers and has notified the authorities. It stressed that protecting customers’ personal data is of paramount importance to the company.
According to media reports, several airlines were affected by the unauthorised access to Amadeus’s platform. Some airlines said the data breaches could affect information processed between August 2023 and September 2026. Amadeus notified the affected airlines between 20 and 28 October.
Amadeus said in a statement that a vulnerability in its travel reservation display environment may have allowed access to certain booking data. Other affected airlines include Malaysia Airlines, Cathay Pacific, Japan Airlines, All Nippon Airways, Korean Air and Asiana Airlines. Cathay Pacific said 53,000 flight booking records were affected, while Japan Airlines and All Nippon Airways said the incident affected 92,000 and 37,800 customers respectively.
The Amadeus incident is SIA’s second-largest customer data breach in recent years. In February 2021, a breach of air transport technology company SITA’s passenger service system exposed the data of about 580,000 SIA KrisFlyer and PPS Club members.
Lianhe Zaobao has contacted the Cyber Security Agency of Singapore and the Personal Data Protection Commission for further information.
