Key facts
- Singapore Airlines said names, booking reference numbers, travel itineraries and booking classes were among the data accessed.
- For about 620 booking records, email addresses, phone numbers, travel document details and KrisFlyer numbers may have been accessed, the airline said.
- Amadeus confirmed to Singapore Airlines that bank account and credit card information was not exposed and no bookings were modified.
- Singapore Airlines said the incident was confined to Amadeus' platform and did not involve a breach of its own IT systems.
- The airline said it is contacting affected customers with upcoming travel to change their booking reference numbers.
- Cathay Pacific reported 53,000 affected bookings and Japan Airlines 92,000 customer records, The Straits Times reported.
Singapore Airlines said about 46,000 of its booking records were accessed without authorization after a data breach at Amadeus, the Spanish travel technology provider that supports some of the carrier's reservations and booking processes. An airline spokesperson said in a media reply on November 3 that the data illegally accessed by a third party included customers' names, booking reference numbers, travel itineraries and booking classes.
For about 620 booking records, the spokesperson said email addresses, phone numbers, travel document details and KrisFlyer membership numbers may also have been accessed. Amadeus confirmed to the airline that bank account and credit card information was not exposed and that no bookings were modified, according to the spokesperson.
The airline said the incident was confined to Amadeus' platform and did not involve a breach of its own IT systems. Amadeus has told Singapore Airlines it implemented containment measures and additional security safeguards, the spokesperson said. As a precaution, the carrier said it is directly contacting affected customers with upcoming travel to change their booking reference numbers, and it has informed the relevant authorities.
"SIA sincerely apologises to affected customers for any inconvenience caused," the spokesperson said. "The protection of our customers' personal data is of utmost importance to SIA."
Singapore's Personal Data Protection Commission said in a media reply on November 4 that it is aware of the incident and is investigating, The Straits Times reported. Amadeus said in an October statement on its website that certain booking-display data was available through a software glitch, that its investigations are ongoing and that it found no evidence payment or financial data was accessed. It said it saw no signs the vulnerability was exploited for ransomware and had fixed it and enhanced monitoring.
Other carriers have reported customer data compromised in the Amadeus breach, including Malaysia Airlines, Cathay Pacific Airways, Japan Airlines, Korean Air and Asiana Airlines. The airlines have said the breach may have affected information processed between August 2023 and September 2026. Cathay reported 53,000 affected bookings and Japan Airlines reported 92,000 customer records exposed, The Straits Times reported.