Singapore Airlines has disclosed that approximately 46,000 booking records may have been affected by a cybersecurity incident involving Amadeus, the external technology provider that supports its reservation systems. The incident has raised concerns about the security of passenger information stored and processed through shared travel technology platforms.
The airline said its own internal IT infrastructure was not breached. Instead, the potential exposure involved a booking environment operated by Amadeus, which provides reservation technology to multiple international carriers.
What Passenger Information May Have Been Exposed?
The potentially affected information includes passengers’ names, booking reference numbers, travel itineraries and booking classes.
Singapore Airlines also reported that additional personal information may have been accessed in approximately 620 booking records. These records potentially contained:
Email addresses and telephone numbers
Travel document details
KrisFlyer membership numbers
The airline has not suggested that every affected booking contained all these categories of information. The distinction is important because the scale and type of exposure may vary between individual records.
Were Banking and Payment Details Compromised?
According to the supplied report, Amadeus said customers' bank account information and credit card details were not exposed in the incident. The company also stated that existing reservations had not been modified.
Singapore Airlines similarly emphasised that its internal systems remained unaffected. However, the incident demonstrates that customer information can face risks even when an airline's own network has not been directly compromised.
Singapore Airlines Takes Precautionary Steps
The airline has started contacting passengers whose booking information may have been affected, particularly those with upcoming travel plans.
As a precaution, Singapore Airlines said it would change booking reference numbers associated with affected reservations. This measure is intended to reduce potential risks arising from the exposure of reservation details.
Passengers contacted by the airline should follow instructions received through verified official communication channels. They should also be cautious about unexpected messages or calls referring to their flights, booking details or personal information.
How Did the Amadeus Security Incident Occur?
Amadeus reportedly identified a vulnerability in an environment used to display travel booking information. The weakness may have allowed unauthorised access to reservation-related data stored in that environment.
The company has not provided an overall figure for the number of customers potentially affected across all airlines using its services. Further details about the incident, including its full technical scope and the number of records involved globally, were not available in the supplied report.
The incident highlights the cybersecurity challenges associated with third-party technology providers. Airlines rely on external platforms for reservations and other essential operations, meaning a security weakness at a service provider can have consequences for several businesses and their customers.
Organisations that depend on external technology vendors need effective oversight of data access, security controls and incident response arrangements. Reviewing these safeguards is an important part of Shunyatax's internal audit services.
Other International Airlines Report Customer Data Concerns
The Amadeus incident has also been linked to customer data concerns reported by other international carriers, including Cathay Pacific, Japan Airlines, Malaysia Airlines and South Korea's Asiana Airlines.
According to the supplied report:
Cathay Pacific disclosed that information relating to approximately 53,000 bookings was affected.
Japan Airlines separately reported that data belonging to around 92,000 customers was involved.
Malaysia Airlines and Asiana Airlines were also listed among the carriers reporting concerns connected with the incident.
These figures refer to different categories of records and individuals, so they should not be added together or treated as directly comparable totals. The overall number of affected customers across the airline industry remains unclear from the available information.
Third-Party Technology Security Comes Under Scrutiny
The incident illustrates how interconnected reservation systems can create shared cybersecurity risks. A vulnerability in a service provider's environment may affect information belonging to multiple airlines, even when their individual internal networks remain secure.
For passengers, the key concerns include possible misuse of exposed booking information and targeted communications that appear to relate to genuine travel plans. Customers should verify unexpected requests through an airline's official website or customer-service channels rather than relying on links or contact details in unsolicited messages.