Thai Airways: Passenger Data Exposed in Amadeus Reservation System Breach

Thai Airways International has confirmed that about 60,529 passenger booking records were accessed without authorisation through Amadeus IT Group, the company that runs its reservation and passenger service system. The airline says a further 376 records may also be affected, and these contain more sensitive details, including passport numbers and contact information. Thai Airways issued its statement on 9 November 2026, according to The Straits Times, The Nation and Thaiger. Thai media widely reported it on 10 November. The airline says no credit card data was taken and its own systems were not touched. Thai Airways is now at least the eighth airline in Asia and Europe to trace a breach back to Amadeus. The unauthorised access ran from 10 August 2023 to 23 September 2026, which is more than three years.

What Happened

Amadeus told Thai Airways about the incident. Amadeus is a Spanish company whose systems handle reservations, ticketing and check-in for airlines around the world. In its statement, the airline said the unauthorised access involved booking data stored on Amadeus's infrastructure, not on Thai Airways' own systems. The airline also said its operations were unaffected.

Every outlet reports the same exposure window: 10 August 2023 to 23 September 2026. The Bangkok Post describes the activity as "three years of cybersecurity breaches" involving "the misuse of account credentials." Either way, someone had access to Amadeus-hosted booking data for over three years before it was shut down.

The airline's statement does not use consistent language about how certain it is. The Straits Times and The Nation, reporting the statement in English, say "initial checks indicated" the records "may have been affected." Khaosod English and Thaiger say an investigation "found" the records "had been accessed." Thai PBS, reporting in Thai, says the data was affected. Thai Airways says it is still reviewing what Amadeus has sent it. It also says it had not found any disclosure of the data as of the date of the statement. Readers should treat the figures as preliminary.

According to the airline, Amadeus has revoked the login credentials used for the access, reset all affected passwords, and strengthened monitoring and detection. Thai Airways says it has reported the incident to the relevant Thai authorities. No regulator filing has been made public. The airline says it will notify affected passengers individually once their details are verified.

Thai Airways joins a growing list. In early November, The Record reported breach disclosures linked to Amadeus from Japan Airlines, Cathay Pacific, Korean Air, Asiana Airlines, Singapore Airlines and Malaysia Airlines. The Bangkok Post also names Finnair as an affected Amadeus customer.

What Was Taken

Thai Airways describes two groups of records:

• About 60,529 passenger records: passenger names, booking reference numbers (PNRs), travel dates, flight routes and cabin classes.
• About 376 records: all of the above, plus possibly email addresses, phone numbers, passport numbers, nationalities, frequent flyer membership numbers, flight numbers, ticket numbers, seat numbers and other related details.

Accounts differ on whether the 376 records are part of the 60,529 or in addition to it. The Straits Times, The Nation and Khaosod English all call them "additional" records. That would put the total at about 60,905. The Bangkok Post says the extra data appeared "in 376 of the affected bookings," which makes them part of the 60,529. The airline's own wording, as most outlets report it, supports the "additional" reading. The Bangkok Post's subheadline also gives 50,529 passengers, but its own article body says 60,529, as does every other outlet. The 50,529 figure looks like an editing error.

Thai Airways says credit card data was not affected. This matches what Amadeus told The Record more broadly: that there is "no evidence that payment or financial data was accessed."

How sensitive the data is depends on the group. For most of the 60,529 passengers, the exposure is a name, a PNR and itinerary details. That is not catastrophic on its own, but a name plus a valid PNR is often enough to view or change a booking on airline websites. It is also exactly what a convincing phishing message needs. The 376 records with passport numbers, nationalities and contact details carry a much higher risk of identity fraud.

Why It Matters

This is one vendor compromise affecting many airlines. The Record reports these figures from other carriers: Japan Airlines (92,000 customers), Cathay Pacific (53,000 records) and Singapore Airlines (46,000 records). Thai Airways' figure is in the same range. Amadeus has declined to say how many customers or passengers were affected in total. Since the airlines are all reporting figures of similar size, the total across Amadeus customers is probably several hundred thousand records at least. Neither Amadeus nor any regulator has confirmed an overall number.

Three years went by without detection. The access started in August 2023 and ended in September 2026. Whatever credential or access path was used went unnoticed for a very long time inside a system at the centre of global air travel. Strong defences at the airline itself would not have helped here.

Airlines carry the disclosure burden for a vendor's failure. Thai Airways says it is "verifying information from Amadeus." That means the airline depends on the vendor for its own breach facts. Notification deadlines under Thailand's Personal Data Protection Act and similar laws elsewhere still apply, whether or not the vendor has finished investigating.

Follow-on fraud is the immediate threat. Anyone holding names, PNRs and travel dates can send passengers convincing "flight change," "rebooking" or "refund" messages. These can be timed to the passenger's real trip. Affected passengers should be warned about this specifically.

The Attack Technique

Amadeus has not published a technical account, and different parties describe the breach differently:

• Amadeus, in a statement to The Record, said it had become aware of "a vulnerability affecting a travel booking display environment" through which "certain booking-display data was accessible." It said there were "no indications that this vulnerability has been exploited for ransomware purposes." It declined to say whether the attackers had contacted it.
• The affected airlines describe credential misuse. Cathay Pacific said Amadeus told it the threat actors used "login credentials assigned to its system account." Thai Airways' statement says Amadeus revoked "the login credentials used to gain unauthorised access." The Bangkok Post describes "misuse of account credentials."
• heise online reported in October 2026, after a reader tip, that the heap dump of a Spring Boot application inside an Amadeus booking environment was reachable through an endpoint that required no login. heise says the memory dump contained access credentials and authentication tokens in plain text, including administrator passwords. It reports that these allowed read and write access to the global system. Using that access, heise could search for passengers by last name and see full names, dates of birth, PNRs, and contact, ID and passport data. Most of the records heise checked were for Lufthansa and Condor flights booked through German travel agencies.

These accounts fit together, but nobody has confirmed the link. An unauthenticated heap dump that leaks system credentials is exactly the kind of "vulnerability" that would lead to "misuse of login credentials." However, heise's findings concern German agency data, and neither Amadeus nor Thai Airways has said that the heap dump was how Thai Airways' records were accessed. It is also unclear whether the 2023 to 2026 access was by one actor or several, and nobody has publicly claimed responsibility.

What Organizations Should Do

1. Ask your SaaS and passenger service system vendors for the facts now. Request from Amadeus, or any equivalent vendor, the full list of credentials and system accounts tied to your tenant, the exposure window, and the record-level data affected. Do not wait for the vendor to send it. Set contract terms that require detailed breach data within a fixed number of days.

2. Check for exposed debug and management endpoints. Spring Boot Actuator endpoints such as /heapdump, /env and /configprops should never be reachable without authentication from outside. Scan your internet-facing applications for them, and add this check to your assessments of third-party vendors.

3. Rotate and limit integration credentials. System accounts that connect airlines, agencies and global distribution systems often have long-lived passwords and broad permissions. Rotate them, cut their permissions down to what they actually use, and add IP allow-listing or mutual TLS where the platform supports it.

4. Alert on bulk PNR access. Retrieving more than three years of bookings should have produced unusual query volumes from specific accounts. Set baselines for normal PNR lookup rates for each account and office ID. Alert when an account searches by last name at scale or reads records outside its usual routes or markets.

5. Prepare passengers for phishing. Notify affected customers early and tell them exactly what was exposed. Remind them that the airline will never ask for card details or passwords by email or text. Add extra verification for booking changes made using only a name and PNR.

6. Pay special attention to passport-level exposure. Offer identity-monitoring support to the smaller group whose passport numbers and nationalities were exposed. Flag their frequent flyer accounts for extra checks on redemptions and changes to account details.

Sources: Bangkok Post - THAI passenger data compromised in Amadeus security... | Thai Airways reports passenger data breach The Straits Times | Security vulnerability in flight booking system heise online | More Asian airlines announce data breaches after attack on Spanish... | Thai Airways says 60,529 passenger booking records exposed in Amade... | Thai Airways reports unauthorised access to passenger records | "การบินไทย" แจ้งข้อมูลผู้โดยสารรั่วไหล 60,529 รายการ Thai PBS News... | Thai Airways reports data breach affecting 60,529 passengers Thaiger