Around 46,000 Singapore Airlines (SIA) booking records were affected by a data breach involving Amadeus, a global travel technology provider that supports some of the airline’s reservation and booking operations.
The incident saw an unauthorised third party gain access to customer booking information, including names, booking reference numbers, travel itineraries and booking classes.
SIA confirmed the incident in response to media queries on 3 November, adding that a smaller group of customers could have had more sensitive personal information exposed.
Around 620 Customers May Have Had Contact And Travel Document Details Exposed
According to SIA, approximately 620 of the affected booking records may have included additional personal information such as email addresses, phone numbers, travel document details and KrisFlyer membership numbers.
This means some customers could potentially face a higher risk of targeted phishing attempts or scams, particularly if their contact details and travel information were accessed.
However, there was some reassurance for affected customers. SIA said Amadeus had confirmed that bank account and credit card information were not exposed in the incident.
The airline also stressed that no bookings had been modified as a result of the breach.
SIA Says Its Own IT Systems Were Not Compromised
SIA clarified that the incident was confined to Amadeus’ platform and did not involve a breach of the airline’s own IT infrastructure.
Amadeus, which provides technology solutions to airlines and other travel industry operators, supports certain reservation and booking processes for SIA.
Following the incident, the company informed SIA that containment measures had been implemented, alongside additional security safeguards to prevent further unauthorised access.
As a precautionary measure, SIA is contacting affected customers who have upcoming travel plans to arrange changes to their booking reference numbers.
The airline has also notified the relevant authorities about the incident and apologised to customers who may have been affected.
Other Major Airlines Also Affected By Amadeus Breach
SIA is not the only airline to have reported customer information being compromised in the Amadeus incident.
Other carriers that have disclosed potential exposure include Malaysia Airlines, Cathay Pacific Airways, Japan Airlines, Korean Air and Asiana Airlines.
The affected airlines have indicated that the compromised information may involve bookings processed between August 2023 and September 2026.
Cathay Pacific reportedly identified around 53,000 affected bookings, while Japan Airlines disclosed that approximately 92,000 customer records had been exposed.
The scale of the incident raises concerns about the security of third-party technology providers, particularly when airlines rely on external platforms to process large volumes of customer information.
SIA Has Experienced Previous Customer Data Breaches
This is reportedly the third data breach involving SIA and its associated businesses since February 2021.
In the earlier incident, approximately 580,000 KrisFlyer and PPS Club members were affected after servers belonging to Sita, an air transport information technology provider, were compromised.
Information exposed included membership numbers, membership tier status and, in some cases, members’ names.
Another incident occurred in 2022 when KrisShop, SIA’s in-flight retail business, was targeted in a phishing attack.
The incident exposed personal information belonging to 4,749 customers, including names, email addresses, residential addresses, contact numbers and KrisShop e-voucher numbers.
Bank account numbers belonging to approximately 165 customers and KrisFlyer account numbers belonging to 17 individuals were also exposed.
The latest incident once again highlights the importance of cybersecurity safeguards across the aviation industry, especially when customer information is handled by external service providers.