Personal and travel data on 144,249 passengers of Norwegian and its subsidiary Widerøe has been exposed, according to a letter Norwegian sent to Norway's Data Protection Authority (Datatilsynet). Norwegian broadcaster NRK and Danish broadcaster DR obtained the letter. NRK reports that it links the leak to the long-running intrusion at Amadeus IT Group, the Madrid-based reservation platform used by much of the travel industry. Norway's National Security Authority (NSM) says the attacker had access to Amadeus systems for at least three years before the vulnerability was closed on 23 September 2026. Norwegian has not published its own public statement. In the letter, the company says it is still assessing whether the breach is serious enough that it must notify affected passengers individually. Datatilsynet has confirmed to NordiskPost that it received breach notifications from Norwegian and from the business travel agency Berg-Hansen.
What Happened
Accounts give slightly different dates for when the breach came to light, but they agree it was in late October:
- 26 October: Berg-Hansen received notice of the intrusion, according to the company's CEO, Per Arne Villadsen, speaking to NRK.
- 27 October: NSM received a report from Berg-Hansen about bookings handled through Amadeus. The Local, citing NRK, gives the same date for when Norwegian became aware of the breach.
- 20 to 28 October: Amadeus notified affected airlines during this period, according to PhocusWire as cited by Travel News Norge. Japan Airlines says it received notice on 23 October.
- 6 November: NSM published an advisory and raised Norway's national cyber risk level to HIGH, the second-highest level. On the same day, Norwegian and Berg-Hansen confirmed to NRK that they had been affected.
- 12 November: NRK reported the 144,249 figure from Norwegian's letter.
Every outlet that reports the passenger count gives the same figure: 144,249. That includes NRK, The Local, NordiskPost and others.
Reports disagree on how many Norwegian organisations had their travel bookings exposed. NRK's 12 November report says the attacker had access to trips booked by 75 Norwegian state and private organisations, possibly including the Norwegian Armed Forces. An earlier NRK report, carried by Adresseavisen on 6 November, described a worst case in which bookings by private individuals and more than 190 Norwegian organisations had been exposed. The 75 figure is the more recent of the two, but neither NRK nor NSM has explained why the numbers differ.
Reports also disagree on when the intrusion took place. NSM says access lasted at least three years. Several airlines, cited by Travel News Norge, put it at August 2023 to September 2026. The breach-tracking site Teollimi cites aeroTELEGRAPH as saying the Amadeus access happened on 21 September 2026. That date may refer to a single event within the longer intrusion, and it does not fit the multi-year timeline that NSM and the airlines describe. Treat it with caution.
What Was Taken
NSM and Norwegian's letter, as reported by NRK, list similar categories of data. They say the exact data exposed varies with the type of booking:
- Passenger identity and full itinerary
- Travel document data, including passport number and nationality
- Contact details
- Ticket number and flight number
- Seat information
- Details of travel companions or the booking travel agency
- Special service requests
- Free-text notes attached to the booking (listed by NSM and NRK)
Everyone reporting on the breach agrees that no payment card data was exposed. Teollimi, citing aeroTELEGRAPH, also lists dates of birth. Neither NSM nor Norwegian's letter, as reported, mentions dates of birth, so that detail is unconfirmed. NordiskPost points out that the list describes data that could have been accessed across the whole Amadeus incident. It does not show which fields were exposed for any individual Norwegian or Widerøe passenger.
The free-text and special-service fields matter more than they might seem. In real bookings these fields often hold medical needs, accessibility requirements, dietary notes tied to religion, and internal notes from agents about VIP or security-sensitive travellers.
Why It Matters
This is one incident at a supplier, with many companies affected. Norwegian is one of a growing list of airlines confirming exposure through Amadeus. Travel News Norge counts at least nine airlines in Asia and Europe, and its reporting adds:
- SAS: about 350,164 travellers in four countries (NordiskPost)
- Japan Airlines and its subsidiary: about 92,000 customers (BleepingComputer)
- Cathay Pacific: about 53,000 bookings
- Singapore Airlines: about 46,000 bookings (Reuters)
- Finnair: about 116,000 reservations
Other confirmed victims include ANA, Korean Air, Asiana Airlines, Malaysia Airlines and Condor. Teollimi also names Thai Airways. Qantas says it is still investigating. These figures cannot simply be added up, because some airlines count passengers, some count bookings and some count reservations. Amadeus has not disclosed the total number of airlines or passengers affected.
The data is valuable for intelligence work, not just for criminals. Three years of itineraries, passport numbers and travel-agency records for government and corporate travellers is the kind of dataset state intelligence services collect. It can be used to map who travels where, with whom and how often. NSM's involvement points the same way: it published an advisory, raised the national risk level and warned organisations "whether or not they are covered by the Security Act". Berg-Hansen says it has notified "politically sensitive" clients. No one has publicly attributed the intrusion to any actor.
Real booking details make scams more convincing. Datatilsynet has warned that fraudulent messages quoting genuine travel information will be harder to spot. Expect phishing that cites real flight numbers, dates and booking references, often posing as refunds, compensation or rebooking offers.
The Attack Technique
Few technical details are public. According to NRK, Amadeus says on its own website that it found "a vulnerability affecting the system that displays travel bookings" and that "certain booking data became accessible." NSM says the vulnerability was closed on 23 September 2026 and that, according to Amadeus, the attacker no longer has access.
Two things stand out from what is known:
- The exposure lasted a very long time. Unauthorised access appears to have gone unnoticed for roughly three years. That suggests a quiet, low-volume method of collecting data rather than a single bulk theft.
- It looks like a flaw in how bookings are displayed. The description points to a weakness in how booking records are retrieved or shown, possibly an access-control gap, rather than ransomware or a stolen-credential attack on the airlines themselves. Travel News Norge reports that Finnair was told about 750 of its reservations were actually opened. That suggests the attacker selected specific bookings rather than downloading everything.
The airlines' own systems are not reported to have been compromised. The exposure happened in the shared Amadeus platform, which means one weakness reached every customer of that platform.
What Organizations Should Do
- Review trips booked before 23 September 2026. This is NSM's lead recommendation. Treat any travel booked before that date as potentially known to an outsider, especially upcoming trips by executives, government staff or security-sensitive personnel. Change plans where the exposure creates real physical or operational risk.
- Reset travel-agency portal credentials. NSM advises changing passwords on travel agency websites. Do the same for corporate booking tools, and check that multi-factor authentication is turned on.
- Brief staff on travel-themed phishing. Warn employees that messages quoting real flight numbers, seats or booking references are not proof of legitimacy. Send all rebooking and refund requests through official apps or by calling the airline directly.
- Audit free-text booking fields. Ask your travel management company what you or they enter in notes and special-service fields. Stop putting sensitive details there, such as security arrangements, medical information or internal job titles.
- Include reservation platforms in supplier risk reviews. Global distribution and reservation systems like Amadeus hold sensitive data about your staff, yet they rarely appear in supplier risk reviews. Ask your travel management company and airlines for written confirmation of what data was exposed and how long they keep booking records.
- Check whether you have to notify a regulator. If your organisation booked through Berg-Hansen, Egencia or other agencies that use Amadeus, check whether your own data-protection notification duties are triggered. Do not assume the airline's filing covers you.
Sources: More than 140,000 travellers with Norwegian affected by data leak | Norwegian and Widerøe data breach affects 144,249 travellers | Over 144.000 Norwegian og Widerøe-passasjerer rammet av datainnbrud... | Data breach exposes travel details of 144,000 Norwegian and Widerøe... | NRK, Reiseliv Sensitive reiseopplysninger har vært på avveie siden... | Norwegian data breach (Nov 2026): was I affected? | SAS, Norwegian og Finnair blant flyselskapene som er rammet av Amad... | Reiseopplysninger kompromittert hos spansk leverandør - Nasjonal si...