Scandinavian Airlines (SAS) has told Sweden's privacy regulator, the Swedish Authority for Privacy Protection (IMY), that booking details for 350,164 people may have been exposed. The data leaked through a breach of Amadeus, the Spanish company that runs booking and check-in systems for airlines around the world. SVT Nyheter first reported the filing on 9 November, and SAS confirmed the incident to SVT and NRK in written statements. That makes SAS the largest single victim yet disclosed in the Amadeus incident. The airline says the data is mostly older bookings and completed trips, judges the risk under GDPR to be low, and has decided not to notify affected passengers individually. It says it could change that decision if new information emerges. SAS has not published a press release, so the public details come from its filing to IMY and its statements to the press.
What Happened
An outside party got into the Amadeus booking system and ran automated searches against reservation records, SVT reports. SAS told SVT that it "is aware of the security incident reported by Amadeus and has been informed that certain booking information linked to SAS has been affected." It added that it has made "the necessary reports to the relevant supervisory authorities" and is following developments while Amadeus continues its investigation.
SAS is registered in Sweden, so IMY received the filing. NRK reports that SAS's own review found affected passengers in four countries: Denmark, Sweden, Norway and Spain. SAS has not said how many are in each country.
The incident first became public in Norway. On 6 November, NRK reported that someone had been able to see records in the Amadeus system, including trips booked by Norwegian businesses and state companies, for as long as three years. The Contrail attributes the three-year estimate to Norway's National Security Authority (NSM). BestSecurity reports that the Norwegian travel agency Berg-Hansen raised the alarm with NSM on 27 October. According to The Contrail, Amadeus says the hole was closed on 23 September. Amadeus has not publicly said how many airlines were affected.
SAS is one of a growing list of victims. Finnair says about 116,000 of its reservations were on flight lists that were accessed. It says roughly 750 of those bookings were actually viewed, 30 of them package trips sold by its tour operator Aurinkomatkat. Norwegian Air and Berg-Hansen have reported the incident to Norway's data protection regulator. The Contrail also lists Singapore Airlines, Cathay Pacific, Japan Airlines, ANA, Korean Air, Asiana, StarFlyer, Malaysia Airlines and Condor as affected, and says Qantas is still checking.
What Was Taken
SAS told IMY that the data identified so far in its dataset is "mainly metadata linked to historical booking records and completed trips." It lists booking references, dates, flight-related information and the number of passengers on each booking. SAS says it has found no "further categories of personal data" so far. NRK reports that SAS considers it unlikely that sensitive data such as passport details was exposed.
Accounts disagree on passport data:
- SAS says passport details were probably not exposed in its dataset.
- Amadeus, as reported by Aviacionline and cited by Deep Arrival, says no credit card numbers or passwords were accessed, but that passport numbers and contact details were exposed in some cases across the wider incident.
- BestSecurity notes that NRK has reported passport data may have been accessible in some cases, and calls the question unresolved.
These claims may not actually contradict each other. Different airlines' records in Amadeus hold different fields, so SAS's subset may be thinner than other carriers'. Until Amadeus or SAS publishes more detail, readers should treat passport exposure for SAS passengers as unconfirmed but not ruled out.
All outlets that cite the SAS filing give the same figure of 350,164 people. Some headlines round it to "up to" or "over" 350,000. Note that this counts people, while Finnair's 116,000 counts bookings, so the two numbers can't be compared directly.
Why It Matters
The breach happened at a supplier, not at SAS. SAS's own systems were not breached. Its passengers' data sat in a third-party platform that dozens of airlines share. One compromised set of credentials at Amadeus led to disclosures by carriers across Europe and Asia.
The attacker may have been inside for years. If NSM's estimate of at least three years of access is correct, the intruder had a long time to collect data quietly before anyone noticed. NRK's reporting that the exposed records include travel by state companies raises intelligence concerns as well as privacy ones. Travel patterns of officials and executives are valuable to state-backed collectors even without passport numbers.
"Low risk" booking data is good material for phishing. SAS's decision not to notify passengers rests on the view that booking references and dates are low sensitivity. But a real booking reference, route and date is exactly what makes a fake "refund", "compensation" or "rebooking" message believable. Finnair took the opposite approach: it reissued booking codes for affected active bookings, is emailing customers, and its CISO Timo Arndal says the airline is "demanding a detailed clarification from Amadeus." Some passengers will now get a warning and others will not, depending on which airline they flew.
The full scope is still unknown. Amadeus has not said how many airlines or records were affected, and new disclosures are still coming in. More European carriers may follow.
The Attack Technique
According to SVT's reporting of the SAS filing, the outside party used "compromised system credentials" to log in to the Amadeus booking system and then ran automated searches to pull reservation data. Nobody has publicly said how the credentials were obtained, for example through infostealer malware, phishing, or a third-party integration. No threat actor has been named or has claimed the attack.
The pattern is familiar. Valid credentials were used to log in instead of exploiting a vulnerability. Bulk queries were then run through what looks like legitimate application access. Because the activity looked like normal use, it was hard to tell apart from real traffic. That fits with the reported multi-year dwell time and with the breach being found by a travel agency customer rather than, as far as is publicly known, by Amadeus's own monitoring.
What Organizations Should Do
- Map which suppliers hold your customer data. List every SaaS and platform provider that stores or can query your customers' records, including reservation, CRM and ticketing systems. Make sure contracts require breach notification within set deadlines and give you the right to receive the specific records exposed for your organisation.
- Watch for bulk queries on shared platforms. Ask providers for API and query logs covering your data. Alert on unusual query volume, automated access patterns and lookups of historical records that normal operations rarely touch.
- Lock down service and integration credentials. Rotate system and API credentials on a schedule. Bind them to known IP ranges or devices where the platform allows it, enforce MFA or certificate-based authentication, and check infostealer log feeds for leaked credentials belonging to your staff and partners.
- Reissue exposed identifiers, as Finnair did. If booking references or similar lookup tokens are exposed, issue new ones for active records so attackers can't use them to view or change bookings.
- Assume phishing will follow and prepare for it. Even if you decide individual notification isn't legally required, publish a clear advisory telling customers that you will never ask for card details or credentials, and that they should open your app or website directly instead of clicking links in messages about refunds or changes.
- Protect travel data about executives and officials. If your travel bookings go through shared reservation platforms, treat itineraries for senior staff and sensitive roles as sensitive data. Review what metadata is stored and how long it is kept.
Sources: 350,000 SAS passengers may have had details leaked in major data br... | Amadeus Data Breach: Full List of Affected Airlines | DN Direkt – Misstänkt dataläcka – SAS-kunder kan fått uppgifter röjda | Personalia fra 350.000 SAS-passasjerer lekket - NRK | SAS hacket – flere end 350.000 personer berørt TV 2 Kosmopol | Amadeus Breach Hits 350,000 SAS Bookings: What Travelers Can Do | Misstänkt dataläcka hos SAS – över 350 000 bokningsuppgifter kan ha... | SAS hacket: Hvad betyder det for dig, og hvad gør BestSecurity? Be...