Amadeus Breach Exposes 46,000 Singapore Airlines Bookings

What exactly was exposed in the Amadeus breach?

The stolen data is the kind that makes phishing emails look terrifyingly real.

According to Singapore Airlines, the 46,000 affected records include passenger names, booking reference numbers, travel itineraries, and booking classes. For around 620 of those records, the exposure goes further: email addresses, phone numbers, travel document details, and KrisFlyer membership numbers were also accessible.

The airline stressed that its own IT systems were not breached. The data was exposed through a vulnerability at Amadeus, the Spanish travel technology company that airlines and airports use to manage reservations and passenger information. Amadeus said it became aware of a vulnerability affecting a 'travel booking display environment' and that there is no evidence payment or financial data was accessed. The company has fixed the flaw and added enhanced monitoring.

A single vendor, a growing list of airlines

Singapore Airlines is just the latest carrier to confirm exposure from the same Amadeus incident.

Cathay Pacific said about 53,000 bookings were affected, with unauthorized access occurring between August 2023 and September 2026. Japan Airlines reported 92,000 affected customers, including roughly 2,000 whose passport numbers were exposed. All Nippon Airways said 37,800 customers were affected, with about 1,700 facing additional data exposure. Korean Air, Asiana Airlines, and Malaysia Airlines have also confirmed they were affected, while Qantas said it is still investigating.

The common thread is Amadeus. Airlines rely on a small number of global distribution systems to handle bookings, and when one of those systems has a flaw, the fallout spreads across carriers that compete fiercely with each other. Cathay Pacific said the threat actor used login credentials assigned to a system account — a detail that suggests the breach may have involved compromised access rather than a sophisticated exploit.

So far, no threat actor has claimed responsibility, and there is no indication the stolen data has surfaced on the dark web. That could change. The data is valuable for extortion or for sale to other criminals.

Why this data is a gift to scammers

Booking records are phishing gold because they let criminals reference real trips and real names.

A phishing email that says 'Your flight SQ123 to London on December 5 has been changed' is far more convincing when the sender actually knows your booking reference, destination, and travel dates. That is exactly what the exposed data provides. Criminals can use it to trick travelers into clicking malicious links, sharing login credentials, or paying fake change fees or refunds.

Passport details and frequent flyer numbers add another layer of risk. They can help criminals impersonate customers, attempt account takeovers, or commit identity fraud. Even without payment card data, the combination of travel details is enough to craft scams that are difficult to spot.

Singapore Airlines is contacting affected customers with upcoming travel plans to change their booking reference numbers as a precaution. If you receive such a message, verify it through the airline's official app or website before acting.

• Be suspicious of any email or text about your booking that asks you to click a link or pay a fee.
• Check your booking directly through the airline's official app or website, not through links in messages.
• Monitor your frequent flyer account for unusual activity and enable two-factor authentication if available.
• If your passport details were exposed, watch for identity fraud and consider a credit monitoring service.

What it means for you

If you have flown with Singapore Airlines, Cathay Pacific, Japan Airlines, ANA, Korean Air, Asiana, or Malaysia Airlines since August 2023, your booking data may have been exposed. The airlines are notifying affected customers directly. Travelers in the US, UK, and EU should treat any unsolicited message about their bookings with extra caution, especially if it includes real details from a past trip.

There is no indication that payment data was stolen, so you do not need to cancel cards. But changing your booking reference and watching for phishing attempts is wise. The airlines have not announced any compensation or credit monitoring offers yet.

The Amadeus incident shows how quickly a single vendor flaw can ripple across the airline industry. For travelers, the lesson is simple: booking data is valuable, and a convincing phishing email is only a few details away. Stay alert, verify everything through official channels, and don't assume your airline's silence means you're safe.