Singapore Airlines Data Breach: 46,000 Booking Records Exposed

Singapore Airlines has confirmed that a cybersecurity incident involving its reservation technology provider, Amadeus, may have impacted approximately 46,000 booking records.

Details of Compromised Passenger Data

The affected records include customer names, booking reference numbers, travel itineraries, and booking classes. In a subset of 620 reservations, additional personal information such as addresses, phone numbers, travel document details, and KrisFlyer membership numbers may have been accessed. The airline clarified that not all affected bookings contained all these data categories.

Financial and Payment Information Status

Amadeus confirmed that no banking or payment details, including credit card information, were exposed during the incident. The company also stated that existing reservations were not altered.

Mitigation Measures by Singapore Airlines

The airline has initiated contact with passengers whose upcoming travel plans may be affected. To address potential risks, Singapore Airlines plans to issue new booking reference numbers for affected reservations. This step aims to mitigate concerns related to the exposure of reservation data. No changes to travel arrangements have been reported as a result of the breach.

Breach Mechanism and System Vulnerability

Amadeus identified a vulnerability in a system used to display travel bookings, which could have allowed unauthorized access to reservation-related data. The company did not disclose the total number of customers impacted across all airlines using its services. The incident underscores the risks associated with shared reservation systems, where a single vulnerability can compromise data across multiple organizations.

Impact on Other Airlines

Several international carriers have reported data exposure linked to the Amadeus incident. Cathay Pacific noted that approximately 53,000 bookings were affected, while Japan Airlines reported data breaches involving around 92,000 customers. These figures represent varying data categories and are not directly comparable. The breach highlights how third-party technology vulnerabilities can expose customer information across multiple airlines without requiring direct access to their internal networks.