Singapore Airlines has disclosed that approximately 46,000 booking records may have been affected by a cybersecurity incident involving Amadeus, its reservation technology provider. The disclosure adds the airline to a growing list of international carriers reporting potential customer data exposure linked to the breach.
The airline said the incident involved a booking-related technology environment operated by Amadeus. It clarified that its own information technology systems were not breached, indicating that the reported exposure was connected to its external reservation technology provider rather than a direct intrusion into the airline’s internal systems.
The development has raised fresh concerns about the security of passenger information stored and processed across the global aviation industry’s interconnected technology platforms.
What Customer Information May Have Been Exposed?
According to Singapore Airlines, the information potentially affected includes customers’ names, booking reference numbers, travel itineraries and booking classes.
The airline also indicated that additional personal information, including email addresses, phone numbers and travel document details, may have been involved. The exact categories of exposed information could vary between affected bookings.
Booking references and travel itineraries can reveal sensitive details about passengers’ travel plans. If combined with other personal information, such data could potentially be misused in targeted phishing attempts or fraudulent communications.
However, the airline’s disclosure does not establish that all the listed information was accessed in every affected booking record.
Affected Passengers to Receive Booking Reference Changes
Singapore Airlines said it is contacting customers whose upcoming travel plans may be affected. As a precautionary measure, the carrier is changing their booking reference numbers to reduce the risk of unauthorised use.
Passengers who receive communication from the airline are advised to follow the instructions provided through official channels. Customers should also remain cautious about unexpected emails, phone calls or messages requesting passwords, payment information or travel document details.
The airline’s confirmation that its own IT systems were not breached is an important distinction, although it does not remove the potential risks associated with information exposed through the third-party platform.
Amadeus Incident Affects Multiple International Airlines
Singapore Airlines is not the only carrier to report potential customer data exposure connected to the Amadeus incident. Cathay Pacific Airways, Japan Airlines and South Korea’s Asiana Airlines have also reported that customer information was affected. Malaysia Airlines has separately said some of its customer information may have been involved.
The disclosures highlight the interconnected nature of airline reservation systems. Airlines depend on specialised technology providers to manage bookings, passenger information and other essential travel services. A security incident involving a shared technology environment can therefore have implications for multiple carriers.
Amadeus said it had become aware of a vulnerability affecting a travel booking display environment. However, it did not provide a figure in response to a question about the total number of customer records potentially affected.
Cybersecurity Risks for the Global Aviation Industry
The incident has renewed attention on third-party cybersecurity risks in the aviation sector. Airlines handle large volumes of personal and travel-related information, making reservation platforms an important part of their digital security infrastructure.
As carriers increasingly depend on external technology providers, protecting passenger information requires security measures across the entire service ecosystem, not just an airline’s internal network.
For affected passengers, the immediate priority is to monitor official airline communications, check booking details through verified channels and be alert to suspicious messages claiming to relate to their travel plans.
The full scale of the incident remains unclear, including the total number of records affected across airlines and the precise categories of information exposed. Further clarification from Amadeus and the affected carriers will be important in establishing the extent of the breach.
