Singapore Airlines says Amadeus incident may have affected 46,000 booking records

Singapore Airlines has said that about 46,000 of its booking records may have been affected by a cybersecurity incident involving Amadeus, the reservation technology provider that supports some of its booking processes. In a media reply on 3 November 2026, the airline said the incident was confined to Amadeus’ platform, involved unauthorised third-party access to customer data held there, and did not involve a breach of Singapore Airlines’ own IT systems.

The supplier boundary is central to an accurate account. The airline’s own network was not the reported point of failure, but its customers’ booking data was held on a system operated by another company. That distinction clarifies where the reported access occurred. It does not remove those records from the incident.

What the airline says was accessed

According to the airline, the data included customers’ names, booking reference numbers, travel itineraries and booking classes. For about 620 booking records, email addresses, phone numbers, travel document details and KrisFlyer membership numbers may also have been accessed.

Those figures describe booking records, not a count of people. The 620 figure is a subset of records with additional data categories, not a separate group of 620 customers. None of the disclosures cited here gives a number of individuals affected.

Singapore Airlines also said Amadeus had confirmed that bank account or credit card information was not exposed and that no bookings were modified. Those assurances came through the airline and Amadeus; they are not an independent forensic finding. The data mix still includes names and travel details, so the statement that payment information was not exposed does not mean that no personal data was involved.

Why the supplier boundary matters

Amadeus supports some of Singapore Airlines’ reservation and booking processes. The reported access was to customer data held on the supplier’s platform, which is why the airline can say its own IT systems were not breached while still acknowledging that its customers’ records were affected. A supplier incident can expose an airline’s customers without penetrating the airline’s network.

Amadeus said it had become aware of a vulnerability affecting a travel booking display environment, according to Reuters copy published by The Standard. According to an AsiaOne report carried by Malay Mail, a statement posted on Amadeus’ website in October described certain booking-display data as available through a software glitch. That report said Amadeus described investigations as ongoing, saw no evidence that payment or financial data had been accessed, saw no signs the vulnerability had been exploited for ransomware, and had implemented measures to fix the vulnerability plus enhanced monitoring and detection. These are company statements as reported, not independently verified findings.

A separate iThome report said Amadeus discovered the vulnerability in September and patched it that month, and that the company had about 141 airline customers. Those details were not corroborated by the other reporting cited here. No CVE identifier, severity rating, affected software version or fixed version appeared in the reporting cited here. Singapore Airlines said Amadeus had told it that containment measures and additional security safeguards were implemented after the incident; that is a company statement about remediation, not a verified patch. The relationship between the display-environment vulnerability described by Reuters and the booking records described by the airline has not been established in the reporting cited here.

A shared problem across airlines

Other carriers have reported possible exposure in the same Amadeus incident. The Reuters copy named Cathay Pacific Airways, Japan Airlines, Asiana Airlines and Malaysia Airlines; The Straits Times also listed Korean Air. The published lists varied. The airlines said the incident may have affected information processed between August 2023 and September 2026.

Cathay Pacific reported 53,000 affected bookings and Japan Airlines reported 92,000 customer records exposed, according to Reuters and The Straits Times. Those numbers use different units. They also cover different carriers and may reflect different stages of disclosure. Bloomberg reported that the global number of bookings compromised across the industry in the Amadeus incident exceeded 200,000, but that aggregate cannot be reconciled with the individual figures cited here.

The response and the regulator

Singapore Airlines said it was directly contacting affected customers with upcoming travel plans to change their booking reference numbers as a precaution, had informed the relevant authorities and had apologised to affected customers. Changing a booking reference is a response to possible exposure. It is not evidence that data has been misused or that the underlying issue has been fully resolved.

The Straits Times reported that Singapore’s Personal Data Protection Commission said in a media reply on 4 November 2026 that it was aware of the incident and was investigating. The report gave no finding, sanction or conclusion. An investigation is a process, not an outcome.

What remains unresolved

The reports cited here identify no attacker, group or state behind the access. They contain no evidence that the data has been published, sold or used for fraud. They do not give a count of individuals affected, a complete list of carriers or an Australian customer count. They also do not establish that unauthorised access is ongoing or that Amadeus’ remediation is complete.

A primary advisory from Amadeus, a regulatory finding or evidence that accessed data had been misused would materially change the account. Until then, the central reported fact is narrower than a compromise of the airline’s own network: booking data held by a shared technology provider was reportedly accessed, and the airline has said that tens of thousands of records may be involved. The 46,000 figure is a count of records that may have been affected, not a settled count of travellers.

Ask what the figure of about 46,000 actually counts and the answer sharpens the story: these are booking records, not travellers, and only some of them carry the extra categories of data. Holding a scope that carefully is a learnable habit, because cybersecurity fundamentals works through how access, affected data and unverified claims are described as separate, checkable things, so a number keeps the size it was given. Readers who want to build that habit can explore The Hack Academy's online cybersecurity training programme, which lists cybersecurity fundamentals among its subject areas, with self-paced study and practical exercises set alongside the theory.

Photo Credit: DepositPhotos.com