A widespread Amadeus data breach has compromised around 46,000 booking records at Singapore Airlines, the carrier confirmed on Tuesday. The software security incident, which targeted the travel industry reservation giant, has now exposed more than 200,000 passenger bookings across multiple international airlines including Cathay Pacific and Japan Airlines.
Key points
- Singapore Airlines said about 46,000 customer booking records were exposed by a cybersecurity flaw at reservation vendor Amadeus.
- Exposed records include passenger names, booking reference numbers, travel itineraries and booking classes, with 620 records losing contact details.
- Amadeus confirmed payment details and banking credentials were not leaked, and existing passenger bookings were not altered.
- The incident has affected over 200,000 bookings globally across Cathay Pacific, Japan Airlines, Asiana Airlines and Malaysia Airlines.
How the Amadeus security flaw exposed passenger files
Singapore Airlines announced on Tuesday that approximately 46,000 booking records stored in its external reservation system were caught up in an unauthorised access incident. The breach took place within systems managed by Madrid-based Amadeus IT Group, one of the primary software providers handling global airline distribution and passenger service systems.
Singapore’s flag carrier clarified that its internal corporate computer networks were not penetrated during the attack. The unauthorised access occurred entirely within a booking display environment operated by Amadeus, which acts as the core booking infrastructure for dozens of international flight carriers.
For the vast majority of the 46,000 affected records, the exposed information was limited to traveller names, booking reference codes, flight itineraries and ticket booking classes. Amadeus confirmed to the airline that attackers did not access bank account details, credit card numbers, or passwords, and flight reservations remained unmodified.
A smaller subset of passengers suffered wider data exposure. Singapore Airlines said that for roughly 620 booking records, attackers may have accessed personal phone numbers, email addresses, travel document details, and frequent flyer KrisFlyer membership numbers. The carrier said it has begun contacting customers who hold active flight bookings to issue replacement reference codes as a security precaution.
A growing wave across Asian carriers
The disclosure from Singapore Airlines follows similar warnings from major airlines across the Asia-Pacific region over recent days. A string of announcements reveals that the Amadeus security failure represents one of the largest coordinated third-party data compromises to strike the aviation sector this year.
Cathay Pacific Airways recently disclosed that unauthorised access to Amadeus systems exposed data linked to roughly 53,000 bookings. Japan Airlines reported that the same flaw compromised details belonging to 92,000 customers. South Korea’s Asiana Airlines and Malaysia Airlines have also acknowledged that some of their customer records were swept up in the vulnerability.
In total, reports compiled by Bloomberg Technology place the tally of compromised flight bookings past 200,000 records worldwide. Amadeus acknowledged that it detected a vulnerability affecting a travel booking display environment, though the company has not yet provided an official global count of all travellers affected by the incident.
Why third-party software vulnerabilities persist
Aviation networks rely on shared Global Distribution Systems to coordinate ticketing across partner airlines, travel agents and airport ground handlers. Amadeus, alongside rival platforms Sabre and Travelport, acts as a shared digital clearing house that processes millions of passenger bookings each day.
This reliance on centralised vendors makes travel platforms lucrative targets for cybercriminals seeking personal data. Large-scale software supply chain incidents frequently mirror broader trends seen across government and corporate IT systems, such as when a recent DHS data breach exposed records through external contractor vulnerabilities.
Because reservation data often passes through multiple application programming interfaces, securing customer records requires strict boundary controls across every linked partner. When a display environment or search portal suffers an authentication lapse, automated tools can allow malicious actors to harvest itineraries en masse using predictable booking identifiers.
What happens next for affected travellers
Singapore Airlines said it is monitoring its systems and coordinating directly with Amadeus security teams to prevent further data exposure. Passengers holding upcoming flights whose records were accessed are receiving direct notifications to update their travel identifiers.
Aviation security specialists advise travellers flying with affected carriers to remain alert to targeted phishing attacks. Fraudsters often use stolen itinerary numbers, flight dates and loyalty codes to impersonate airline staff and trick passengers into handing over payment details.
Amadeus has not named the actors behind the breach or specified whether the vulnerability has been closed across all international installations. Regional transport authorities and data protection regulators in Singapore and Japan have begun reviewing the notifications submitted by the carriers.
