Thai Airways says 60,529 passenger records were accessed in the Amadeus breach over three years, including passport numbers for 376 travellers

Was Thai Airways hacked? Not directly, but its passengers' data was. Thai Airways International said on Monday 9 November that Amadeus IT Group, the company that runs its passenger reservation and service systems, had notified it of unauthorised access to booking data stored in Amadeus's systems between 10 August 2023 and 23 September 2026. About 60,529 passenger records were accessed, The Straits Times reported.

For most of those travellers, the exposed data was limited to names, booking references, travel dates, routes and ticket classes. But for about 376 passengers, it included passport numbers, nationalities, phone numbers and email addresses. Credit card details were not affected, the airline said. Thai Airways joins a growing list of carriers hit by the same Amadeus incident across Asia.

What Thai Airways disclosed

According to the airline's statement, Amadeus found that approximately 60,529 passenger records had been accessed. The information included passenger names, passenger name records, the booking reference codes used to manage reservations, travel dates, flight routes and ticket classes.

Around 376 passengers had more sensitive information exposed, including email addresses, telephone numbers, passport numbers, nationalities, frequent flyer membership numbers, flight numbers, ticket numbers and seat numbers, The Thaiger reported. The airline said credit card details were stored securely and were not affected.

Thai Airways said it had not identified any disclosure of the data as of its statement, that it had reported the incident to the relevant agencies, and that it would contact affected passengers individually after completing its checks. It apologised for the concern and inconvenience caused.

The airline did not say how many of the affected passengers were Thai nationals or how many were foreign travellers, or which routes were most affected. Because the access window covered more than three years, anyone who booked a Thai Airways flight during that period could in principle be among the 60,529, although only those contacted by the airline have been confirmed as affected. The numbers are smaller than at some other carriers hit by the same incident, but the long time frame means the data covers many trips.

How the Amadeus breach happened

Thai Airways stressed that the unauthorised access occurred within Amadeus's infrastructure, not its own systems. Amadeus confirmed that it had deactivated the user accounts used to gain access, revoked the login credentials, reset all affected passwords and strengthened monitoring, detection and surveillance to prevent similar incidents.

The length of the access window is striking: more than three years, from August 2023 to September 2026. That suggests the attackers used valid credentials to look at booking data quietly over a long period rather than smashing in and stealing everything at once.

Amadeus provides reservation, check in and departure control systems to hundreds of airlines worldwide, which is why one weakness can affect many carriers at the same time. The same incident has hit several Asian airlines, as we reported in our coverage of the Amadeus breach at Malaysia Airlines, Cathay, JAL and Qantas, and separately exposed about 46,000 Singapore Airlines booking records.

Airlines outsourced their booking systems to save money and gain scale. The Amadeus breach shows they also outsourced a single point of failure.

What passengers should do

For the vast majority of affected travellers, the exposed data is booking information rather than identity documents. That still has value to scammers, who can use names, routes and booking references to send convincing fake messages about flight changes, refunds or upgrades. Passengers should be alert to:

• emails or texts claiming to be from Thai Airways that ask for payment or personal details
• messages that quote your booking reference to appear genuine
• calls offering compensation or refunds that require you to share information
• unusual activity on your frequent flyer account

The 376 passengers whose passport numbers and contact details were exposed face a higher risk of identity related scams and should watch for phishing closely. Thai Airways says it will contact them individually. Travellers can also check their booking and frequent flyer accounts directly through the airline's official website or app, rather than through links in messages.

A difficult period for Thai Airways

The breach comes as Thai Airways faces scrutiny over several operational problems. Chief executive Chai Eamsiri was suspended on 2 October after flooding left thousands of bags stranded at Bangkok's Suvarnabhumi Airport, according to The Thaiger. Last week the airline apologised for a backlog at its inbound cargo warehouse at the same airport, where some shipments had waited since 10 October.

On 4 November, a Thai Airways Boeing 787-9 returned to Shanghai after pilots found a crack in a cockpit window shortly after take off. And this week, aviation blog LoyaltyLobby shared a photo of a water bottle left on a lavatory counter for passengers to wash their hands, claiming a Munich to Bangkok flight had no running water, a report the airline had not commented on.

None of these incidents is related to the data breach. But together they add pressure on an airline that has been rebuilding after a long restructuring, and that wants to compete with regional rivals for premium and long haul passengers.

Why the airline breaches keep coming

Airlines are attractive targets because they hold large amounts of personal and travel data, often in shared systems run by technology providers. A single compromised account at a provider can expose bookings across many airlines and years of travel history, as this case shows.

Regulators across the region are paying closer attention. In Singapore, a cluster of breaches at SPH Media, M1 and others has prompted investigations, as we reported in our analysis of Singapore's week of data breaches. Thailand's own personal data protection law requires organisations to report breaches and protect personal data, including data handled by service providers on their behalf.

For airlines, the lesson is that outsourcing systems does not outsource responsibility. Passengers trust the airline whose name is on the ticket, and that airline will bear the reputational cost when its providers fail.

Thai Airways' passengers are the latest to learn that their data is only as safe as their airline's suppliers. The exposed information is mostly basic booking data, but it covers three years of travel and enough detail to fuel scams. For the airline, already dealing with operational troubles, the breach is one more reason passengers will be watching how it responds.