Thai Airways revealed on Tuesday that about 60,529 of its passenger bookings were compromised in the Thai Airways Amadeus data breach, at the travel technology company that runs its reservation system.
Thai Airways Amadeus data breach: what passenger data was exposed
The Thai Airways Amadeus data breach, carried out through the misuse of account credentials, stretched over a long period, from 10 August 2023 to 23 September 2026, before it was uncovered. The exposed data includes passenger names, booking references, travel dates, itineraries and cabin classes. For 376 bookings, the breach went further, taking in email addresses, telephone numbers, passport numbers, nationalities, and frequent flyer, ticket and seat numbers.
The airline stressed that credit card data was not affected and that its own systems remained intact. The problem sits with a shared supplier rather than with the carrier itself. Thai Airways is not alone: other Amadeus clients are caught up in the same incident, including Cathay Pacific, Malaysia Airlines, Singapore Airlines and Japan Airlines, making this one of the widest aviation data exposures in Asia in recent years.
Thai Airways Amadeus data breach response and what travellers should do
Disclosure of the Thai Airways Amadeus data breach also carries regulatory weight in Thailand, where personal data law requires organisations to notify authorities and affected individuals about serious breaches. The three year span of the intrusions, conducted through legitimate looking account credentials rather than a frontal attack on systems, suggests detection tools focused on the wrong signals, a weakness other industries that rely on Amadeus style platforms will recognise in their own arrangements.
For passengers affected by the Thai Airways Amadeus data breach, the immediate risk is less about payment fraud than about targeted scams. Names, itineraries and passport details are exactly the raw material used in convincing phishing messages that imitate airlines and ask travellers to confirm or pay for a booking. Affected customers are being urged to stay alert to unsolicited messages and to confirm booking details directly with the airline.
The Thai Airways Amadeus data breach shifts the region’s aviation cybersecurity debate. Airlines have spent heavily on securing their own environments, but dependence on shared reservation systems, loyalty programmes and check-in platforms means the weakest link in the whole chain could be somewhere else entirely.
Source: Bangkok Post