Thai Airways data breach exposes 60,529 bookings

A Thai Airways data breach has exposed about 60,529 passenger booking records after unauthorised users got into the Amadeus reservation system the airline relies on, Thai Airways said. The carrier stressed that credit card details were not affected, according to a report by The Thaiger on Tuesday.

In a statement issued on Monday, November 9, the national airline said it had been informed by Amadeus IT Group, the Spanish-based company that provides its passenger reservation and service systems, about the unauthorised access to booking information stored on Amadeus's platform.

What data was exposed

The access was detected over a long period, running from August 10, 2023, to September 23, 2026. For the roughly 60,529 affected bookings, the information involved was limited to basic trip details:

• Passenger names
• Passenger name records (PNRs), the booking reference codes
• Travel dates and flight routes
• Ticket class

A much smaller group of about 376 passengers had more sensitive details exposed. These included email addresses, phone numbers, passport numbers, nationality, frequent flyer numbers, flight and ticket numbers and seat numbers.

Thai Airways data breach: card details safe

Thai Airways said payment card information was stored securely and was not part of the incident. It also said its own systems and operations were not affected, because the intrusion took place inside the Amadeus infrastructure rather than on the airline's network.

Amadeus reportedly told the airline that the user accounts used to gain access have been shut down, all affected passwords have been reset and its monitoring and security controls have been strengthened.

The airline said it has reported the incident to the relevant authorities and will contact affected passengers one by one once it has finished checking the details. It apologised for the worry and inconvenience caused.

Why booking data still matters

Even without card numbers, booking data can be valuable to criminals. A name, booking reference and travel dates are often enough to craft convincing phishing emails or phone calls that appear to come from an airline, asking travellers to "confirm" payments or personal details. Passport numbers and contact details, as in the smaller group of 376 records, raise that risk further.

Thai authorities have repeatedly warned about more sophisticated fraud, including the use of cloned voices, as covered in our report on how Thailand sounds the alarm on AI-powered voice fraud. Financial regulators are also tightening rules, with a recent Bank of Thailand order telling banks to boost cyber defences.

It is not yet clear how the unauthorised users obtained the account credentials, or why the access went unnoticed for so long. Thai Airways has not said whether any of the exposed information has been misused, and further details of the incident may emerge as the airline completes its checks.

What passengers should do

Travellers who have flown or booked with Thai Airways since 2023 can take some simple precautions while waiting to hear from the airline:

• Be wary of unexpected emails, texts or calls that mention your booking or ask for payment
• Check messages come from official Thai Airways channels before clicking any link
• Change your frequent flyer account password and turn on extra security where available
• Watch for any unusual activity linked to your passport or email address

The incident is a reminder that airline data often sits with third-party technology providers. Amadeus systems are used by many carriers worldwide, so any weakness there can affect passengers well beyond a single airline. Thailand has seen a broader rise in cyber incidents, as reported in our look at data breaches tied to pirated software.

The original report was published by The Thaiger, and the Bangkok Post also covered the breach.

Image: A Thai Airways International Airbus A330 in flight, illustrating the Thai Airways data breach story. Photo by Aktug Ates via Wikimedia Commons, GFDL 1.2.