Finnair has confirmed that about 116,000 of its reservations were caught up in the data breach at Amadeus IT Group. Amadeus is the Madrid-based company that runs reservation, ticketing and check-in systems for hundreds of airlines. In a statement published on 9 November, the Finnish airline said Amadeus had told it that about 750 of those bookings were "opened for examination." Of those 750, about 30 were Aurinkomatkat package holidays sold by Finnair Group's tour operator. Finnair has given new reservation numbers to the small share of opened bookings that are still active. Amadeus has told the airline that no credit card numbers or passwords were accessed, and Finnair says its own systems were not breached. Finnair is the latest of a growing list of carriers, most of them so far in Asia, to trace a customer data exposure back to the same supplier.
What Happened
Finnair says Amadeus told it that the breach covered "flight lists of several airlines," including about 116,000 Finnair reservations. Amadeus also says the unauthorised activity has been stopped. The airline's Chief Information Security Officer, Timo Arndal, said: "We have demanded detailed clarification of this incident from Amadeus. Detailed investigation is still ongoing, but Amadeus has already confirmed to us that credit card numbers or passwords have not been accessed. Finnair systems have not been compromised."
Responsibility for telling customers sits mainly with Amadeus. Finnair says Amadeus is the data controller for the affected service, has reported the breach to a data protection authority in an EU member state as GDPR requires, and must notify the people affected. Finnair has not named which authority received the report. Finnair will also email customers whose contact details Amadeus has passed on, and it has contacted the National Cyber Security Centre at Finland's transport and communications agency, Traficom. Passengers can contact Amadeus directly at [email protected].
How many airlines are affected depends on who is counting:
- The Record (4 November) named Japan Airlines, Cathay Pacific, Korean Air, Asiana Airlines, Singapore Airlines and Malaysia Airlines.
- iZOOlogic (3 November) counted at least eight carriers, adding ANA, Japan Transocean Air, Condor and Qantas. It put confirmed volumes above 180,000 records at that point.
- Paddle Your Own Kanoo calls Finnair the seventh major airline to come forward and puts the running total at "at least 344,800 bookings." The outlet has not explained how it reached that figure.
Amadeus declined to tell The Record how many victims there are in total.
The timeline is also not fully settled. iZOOlogic reports that someone had access from 10 August 2023 to 23 September 2026, about 38 months, and that airlines started disclosing from 20 October. Paddle Your Own Kanoo gives a similar period of more than three years, ending in September 2026. Amadeus has not publicly confirmed these dates, and Finnair did not say when the activity took place.
What Was Taken
Finnair's own figure is about 116,000 reservations in the exposed flight lists, with about 750 opened for examination. One outlet, Paddle Your Own Kanoo, gives the figure as 166,000 in the body of its article but 116,000 in its summary. That looks like a typo. Finnair's statement in both English and Finnish says 116,000.
Finnair has not listed which data fields were in its bookings. Across the wider incident, other airlines report the following:
- Cathay Pacific (via The Record): booking numbers, passenger names and flight details. Some records also included passports and other travel documents, frequent flyer numbers and email addresses.
- Singapore Airlines (to Reuters and Bloomberg): confirmation numbers, itineraries and names.
- Paddle Your Own Kanoo: names, booking references, itineraries and booking classes.
- iZOOlogic: mostly booking references, names and itineraries. A smaller set included email addresses, phone numbers, frequent flyer numbers, passport numbers and nationalities.
Every source agrees that no payment card data was accessed. The details differ on one point. Finnair's statement says Amadeus confirmed that neither card numbers nor passwords were accessed. Paddle Your Own Kanoo says Amadeus ruled out card information and email addresses. Cathay Pacific's disclosure says some email addresses were exposed, so Finnair's wording, which covers passwords, should be treated as the reliable version.
The difference between 116,000 bookings in scope and 750 opened matters. A booking reference plus a surname is usually enough to view and change a booking on an airline website. That is why Finnair reissued reference numbers for the active bookings.
Why It Matters
This is a supply chain breach in the most literal sense. One supplier account exposed customers of many airlines at once, and every affected carrier says its own network was untouched. Amadeus's Altéa passenger system is used by about 130 airlines, according to the Finnish aviation site Lentoposti and Paddle Your Own Kanoo. Even an airline with good security of its own can lose passenger data through a system it does not run.
Detection and disclosure were slow. If the access period iZOOlogic reports is right, the activity went unnoticed for more than three years. Airlines were then notified one at a time from late October, about four weeks after access was cut off. Finnair is disclosing in November and is still waiting for Amadeus to give it full details. For defenders, this means you may learn about a supplier breach long after it happened, and with only partial information about your own exposure.
The legal setup adds to the confusion. Because Amadeus is the GDPR data controller for the affected service, notification depends on Amadeus. Finnair can only contact customers whose details Amadeus has passed on.
Booking data is also useful to fraudsters. Real names, booking references and itineraries make convincing material for phishing such as fake rebooking, refund or check-in emails, sent to people who really do have a trip coming up.
The Attack Technique
Amadeus has not published a technical account, and the descriptions so far do not fully match:
- Amadeus, in a statement to The Record, said it "became aware of a vulnerability affecting a travel booking display environment" through which "certain booking-display data was accessible." It said it saw no sign of ransomware, has fixed the vulnerability and has added monitoring.
- Cathay Pacific, also via The Record, said Amadeus told it the attackers used "login credentials assigned to its system account."
- iZOOlogic also describes misuse of valid credentials to read reservation data.
These two accounts can both be true, for example if the vulnerability exposed credentials that were then used to log in, but no one has confirmed how they connect.
There is a possible earlier warning sign. On 13 October, the German tech news site heise online reported a separate Amadeus problem that readers had reported to it. A Spring Boot application exposed its "heap dump", a copy of its working memory, through an endpoint that required no login. heise says the dump held plain-text access credentials, login tokens and administrator passwords, and that these gave read and write access to the global system. heise also says current booking data was searchable by surname and included passport and ID details, mostly for Lufthansa and Condor flights. heise reported the hole appeared to be closed.
No one has publicly confirmed whether heise's finding is the same incident as the multi-airline breach. Condor appears in both, and both involve credentials, but neither Amadeus nor any airline has linked them. No group has claimed the attack, and Amadeus would not say whether the attackers have contacted it.
What Organizations Should Do
- List every supplier that holds your customer data as data controller, not just as processor. Agree in the contract how fast they must notify you and what data they must hand over, including affected record lists and contact details, so you are not waiting weeks for information.
- Reissue booking references, session tokens and similar lookup keys for any active records in scope, as Finnair did. A known reference plus a surname should not be enough to change a live booking after a breach.
- Lock down and monitor supplier service accounts. Require multi-factor authentication or certificate-based login wherever the supplier supports it, rotate credentials on a schedule, and ask for access logs that show which of your records were read and from where.
- Turn off diagnostic endpoints in production. Spring Boot Actuator endpoints such as /heapdump and /env should not be reachable from the internet. Never keep administrator credentials in application memory or configuration in plain text. Ask key suppliers to show evidence that they do the same.
- Warn customers in scope about targeted phishing. Tell them you will never ask for card details or passwords by email about a rebooking, and give them one official channel to check any message.
- Look for unusual bulk reads on booking and display systems, such as large numbers of booking lookups from a single account. If the reported three-year access period is accurate, the reads were too quiet for normal alerts to catch.
Sources: Finnair confirms Amadeus data breach exposed around 116,000 of its... | More Asian airlines announce data breaches after attack on Spanish... | Security vulnerability in flight booking system heise online | Finnair customer data included in global Amadeus data breach - Finnair | Finnair Says 116,000 Reservations Have Been Compromised in Massive... | Amadeuksen globaalissa tietovuodossa on ollut mukana myös Finnairin... | Tietomurto Amadeuksen järjestelmiin - kohteena lentoyhtiöiden matku... | Three Years Undetected: Inside the Amadeus Passenger Data Breach i...