By Hamza Faisal
Singapore Airlines has confirmed that about 46,000 of its booking records were illegally accessed in a data breach at Amadeus, the travel-technology provider that supports some of the carrier's reservation and booking processes. The airline disclosed the exposure in a media reply on November 3, making it the latest major carrier to be drawn into a breach that has now touched airlines across Asia and beyond.
According to the airline, the data accessed by an unauthorised third party included customers' names, booking reference numbers, travel itineraries and booking classes. For about 620 booking records, more sensitive information may also have been accessed, including email addresses, phone numbers, travel document details and KrisFlyer membership numbers.
Singapore Airlines stressed that the incident was confined to Amadeus's platform and did not involve a breach of its own IT systems. Amadeus has confirmed that bank account and credit card information was not exposed, and that no booking was modified as a result of the unauthorised access. As a precaution, the airline said it is directly contacting affected customers with upcoming travel to change their booking reference numbers, and that it has informed the relevant authorities and apologised to affected customers.
A breach that keeps widening
The Amadeus incident first surfaced in October, when the Spanish travel-technology firm said it had found a vulnerability in a travel booking display environment through which certain booking data was accessible. Amadeus said it fixed the flaw, strengthened its monitoring and detection capabilities, and found no evidence that payment or financial data was accessed or that the vulnerability had been exploited for ransomware.
Since then, a growing list of airlines has disclosed exposure. Cathay Pacific, Japan Airlines, Korean Air, Asiana Airlines and Malaysia Airlines have all said customer data may have been compromised, and the airlines' disclosures indicate the unauthorised access may cover information processed between August 2023 and September 2026. Japan Airlines has said Amadeus told it the access window ran from August 10, 2023 to September 23, 2026.
Regulators step in
Singapore's Personal Data Protection Commission said in a media reply on November 4 that it is aware of the incident and is investigating the case. The Straits Times has also contacted the Cyber Security Agency of Singapore for more information, underlining how a single supplier's flaw has turned into a multi-agency matter.
For Singapore Airlines, the disclosure is an unwelcome repeat. The incident is reportedly the third data breach to affect the carrier and its associated businesses since February 2021, when 580,000 KrisFlyer and PPS members had their membership numbers, tier status and in some cases names compromised.
What travellers should watch for
The practical risk for affected customers is not a hijacked booking — Singapore Airlines says none was modified — but targeted scams. A booking reference combined with a name, itinerary and phone number gives fraudsters convincing material for phishing messages posing as the airline, including fake requests to reconfirm details or pay fees.
Customers contacted by the airline about changing a booking reference should follow the airline's own channels rather than links in unsolicited messages, and treat any message asking for payment details or passwords as suspect. Singapore Airlines has not said who accessed the data, how the vulnerability was exploited, or how many individual people — as opposed to booking records — were affected, and those questions remain open as the regulator's investigation continues.
