Singapore Airlines Data Breach: Amadeus Incident Exposes 46,000 Bookings

Approximately 46,000 Singapore Airlines (SIA) booking records were accessed during a cybersecurity breach involving Amadeus, a global travel technology provider. Singapore Airlines confirmed on November 3, 2026, that unauthorized parties gained access to data stored on the Amadeus platform, which manages reservation and ticketing processes for the carrier.

While SIA reported that its internal IT systems remained secure, the breach exposed a range of customer information. For the majority of the 46,000 affected records, the exposed data included passenger names, booking reference numbers, travel itineraries, and booking classes. A smaller subset of approximately 620 records contained more sensitive details, including email addresses, phone numbers, travel document information, and KrisFlyer membership numbers.

Scope of the Amadeus platform breach

The incident at Amadeus has affected at least 15 airlines across Asia, Europe, and Australia, according to The Cyber Express. Cathay Pacific disclosed on October 30, 2026, that unauthorized access to its reservation data occurred between August 2023 and September 2026. Data supplied by Amadeus indicated that 53,000 Cathay Pacific bookings were impacted. Japan Airlines also reported a significant exposure, with unauthorized parties accessing records for approximately 92,000 customers. Malaysia Airlines and Asiana Airlines are also among the carriers caught in the breach.

Security response and customer notifications

Amadeus has implemented security measures to contain the incident, including password resets and enhanced system monitoring, according to statements cited by The Cyber Express. Both Singapore Airlines and Cathay Pacific confirmed there is no evidence that financial information, such as bank account or credit card details, was compromised. Furthermore, no bookings were altered as a result of the unauthorized access.

SIA has begun contacting affected customers with upcoming travel plans to facilitate the modification of their booking reference numbers as a precautionary measure. The airline stated that it has reported the incident to the relevant authorities.

Unresolved questions regarding the incident

Despite these disclosures, several aspects of the breach remain under investigation. As noted by Security Boulevard, the specific timeframe of the unauthorized access to Singapore Airlines data has not been publicly established. The full extent of the impact on other Amadeus clients remains unclear, and the technology provider has so far found no evidence that the accessed data has been misused. Malaysia Airlines has urged passengers to remain vigilant against suspicious or unsolicited communications requesting personal or financial information.

Airlines report no evidence of stolen payment data

Have my credit card or bank details been stolen?
No. According to statements from Singapore Airlines, Cathay Pacific, and Malaysia Airlines, there is currently no evidence that payment or financial data was accessed during the incident.

Should I change my airline account password?
While airlines have not explicitly mandated password changes for all users, they have advised customers to remain alert to suspicious messages. Some carriers, such as Singapore Airlines, are directly contacting individuals whose booking references need to be updated.

Why were other airlines affected by the same provider?
Amadeus operates as a shared third-party technology platform for the travel industry. When a security vulnerability exists within that centralized environment, it can expose the data of multiple airlines that rely on its reservation and ticketing infrastructure.

More on this story: Airlines Affected as Global Amadeus Booking System Breached