Singapore Airlines: 46,000 Booking Records Exposed in Amadeus Reservation Breach

Singapore Airlines (SIA) has confirmed that someone without authorisation accessed data from about 46,000 of its booking records. The access happened on the platform of Amadeus, the Spanish travel technology company that runs part of the airline's reservation and booking processes. SIA gave the figures in a media statement on 3 November, reported by The Straits Times and CNA. The exposed data includes customer names, booking reference numbers, itineraries and booking classes. For about 620 records, contact details, travel document details and KrisFlyer membership numbers may also have been accessed. SIA says its own IT systems were not breached. It is now one of a growing list of carriers, mostly in Asia, hit by the same incident at Amadeus. Some of those carriers say unauthorised access ran from August 2023 to September 2026.

What Happened

According to SIA's statement, an unauthorised third party accessed customer data held on Amadeus' platform. The airline says the incident was confined to Amadeus and did not involve its own systems. SIA says Amadeus has told it that containment measures and extra security safeguards are now in place. SIA has informed the relevant authorities and apologised to affected customers. As a precaution, it is contacting affected customers with upcoming travel and asking them to change their booking reference numbers.

SIA's statement does not say when its records were accessed. Other airlines have been more specific about the overall incident:

• Japan Airlines told customers that Amadeus notified it on 23 October that unauthorised access took place between 10 August 2023 and 23 September 2026, according to BleepingComputer.
• Cathay Pacific said in its own notice that Amadeus informed it on 28 October and sent further details on 29 October. Cathay gives the same window of August 2023 to September 2026.
• Malaysia Airlines gave the same window on 31 October, according to the New Straits Times.

If SIA's exposure falls within that roughly three-year window, older completed trips could be affected as well as upcoming ones. SIA has not said whether customers whose trips are already over will be notified.

SIA is one of several carriers now affected. CNA and The Straits Times name Cathay Pacific, Malaysia Airlines, Asiana Airlines and Japan Airlines. BleepingComputer reports, citing Japanese media, that All Nippon Airways (ANA) has also disclosed a breach tied to Amadeus. The aviation site The Contrail adds Korean Air and StarFlyer to the list and says Condor has reportedly confirmed it was affected. The Contrail also reports that Qantas is investigating whether its bookings were affected, though Qantas has not confirmed any exposure. Amadeus has not published a total count of affected airlines or passengers.

The Straits Times says this is reportedly SIA's third major data incident since 2021.

What Was Taken

For SIA, based on the airline's statement:

• About 46,000 booking records: customer names, booking reference numbers (PNRs), travel itineraries and booking classes.
• About 620 of those records: may also include email addresses, phone numbers, travel document details and KrisFlyer membership numbers.

SIA says Amadeus confirmed that no bank account or credit card data was exposed and that no bookings were changed. SIA has not said how many individual customers the 46,000 records represent. One booking can cover several passengers, and one passenger can appear in several bookings. SIA has also not said whether its low-cost subsidiary, Scoot, was affected.

The picture is similar at other airlines, though counts differ by carrier:

For the smaller group of JAL customers with more detailed data exposed, JAL listed passport numbers, nationalities, frequent flyer numbers, and ticket and seat numbers. Amadeus says it has found no evidence that payment or financial data was accessed. Cathay says that, so far, Amadeus has not identified any misuse of the affected data.

Why It Matters

This is a supply chain breach. The data was taken from a shared platform, not from any one airline's systems. BleepingComputer notes that Amadeus serves more than 400 airlines, 210 airport operators and 2 million hotels, so one weakness there reaches across the whole industry. Every affected airline, SIA included, can truthfully say its own systems were not breached, yet its customers' data was still exposed. Organisations need to treat that distinction with care when assessing their own exposure.

How long the access lasted is the most serious part. Airlines describe unauthorised access going undetected from August 2023 to September 2026. That is three years in which booking data could be collected without anyone noticing. Whatever monitoring Amadeus had in place did not catch it for most of that period.

The data itself is very useful for fraud. A booking reference plus a surname usually opens a booking on an airline's website. Both were exposed for every affected SIA record. That is likely why SIA is reissuing references for upcoming trips, though its statement does not say so. Even without payment data, an attacker who knows a real name, flight and booking reference can write a convincing "schedule change" or "seat fee" message to steal card details. Malaysia Airlines has already warned customers about messages asking for personal or financial information. SIA's own outreach about changing booking references also gives scammers a ready-made message to copy.

Note also how Amadeus' account has developed. BleepingComputer reports that Amadeus' statement on 1 October described the issue as a vulnerability and said ransomware actors had not exploited it. Amadeus repeated that in a statement reported by the New Straits Times. Airline disclosures since then show the vulnerability was in fact used to access customer data over a long period.

The Attack Technique

Accounts differ, and Amadeus has not published a full technical explanation.

• Amadeus describes a vulnerability in its booking-display environment, with no evidence that payment data was accessed and no sign of ransomware use. It says it has fixed the issue and strengthened monitoring and detection.
• Cathay Pacific gives the most specific description from an affected airline. Its notice says the access was made "by an unauthorised party using login credentials assigned to its system account." It adds that Amadeus' containment included a password reset. This points to misuse of legitimate credentials, not a typical software exploit.
• heise online reported in mid-October on an Amadeus booking system exposure flagged by its readers. That exposure mainly involved Lufthansa and Condor bookings and German travel agencies. In heise's initial analysis, a Spring Boot application exposed a heap dump (a snapshot of its memory) through an endpoint that required no login. The dump contained access credentials and authentication tokens, including administrator passwords that heise says allowed read and write access to the global system. heise said passengers could be searched by last name, with names, dates of birth, PNRs, contact details and passport data visible in plain text.

The heise finding and Cathay's account fit together: credentials leaked through an unprotected memory dump would let an outsider log in with valid accounts. However, neither Amadeus nor any airline has confirmed that the heise exposure is the same incident that hit SIA and the other Asian carriers. Until Amadeus says so, treat the link as possible, not proven. No threat actor has been named, and no group has claimed responsibility.

What Organizations Should Do

1. Map your exposure to Amadeus and other shared providers. List every reservation, departure control and booking-display service that holds your customer data. Ask Amadeus directly whether your accounts or office IDs fall within the August 2023 to September 2026 window. Don't wait for a notification.
2. Rotate every credential and token issued to or by the provider. Cathay's account points to stolen service-account credentials. Reset API keys, service account passwords and integration tokens, and check that the old ones are actually revoked.
3. Reissue booking references and add friction to booking lookups. Follow SIA's lead and reissue PNRs for exposed upcoming bookings. Then rate-limit "manage booking" lookups and add extra checks before changes, such as a one-time code sent to the contact details on file.
4. Get ahead of phishing aimed at your customers. Tell affected customers exactly what your real messages will and won't contain, for example that you will never ask for card details to keep a booking. Watch for lookalike domains and pass phishing reports to your national anti-scam services.
5. Check your own applications for exposed diagnostic endpoints. The flaw heise described is a common one. Audit any Spring Boot application for publicly reachable Actuator endpoints, especially /heapdump and /env. Keep secrets out of application memory where possible, and put management interfaces behind authentication and network restrictions.
6. Require faster detection in contracts. Three years of undetected access is a contract problem as well as a technical one. Require providers to log anomalous queries, notify you within set deadlines, and give you enough access-log detail to work out which records were accessed, not only which accounts.

Sources: About 46,000 SIA booking records accessed in data breach involving... | 46,000 SIA booking records accessed illegally in data breach affect... | Security vulnerability in flight booking system heise online | Japan Airlines suffers third-party data breach exposing passenger info | 新航资料外泄: 46,000 笔订票记录经 Amadeus 遭访问, 信用卡资料没有外泄, 现在该怎么做 MissLobang | Amadeus fixes booking system vulnerability amid airline data breaches | Personal data security incident involving a third-party service pro... | Which Airlines Were Hit by the Amadeus Data Breach?