SINGAPORE – About 46,000 Singapore Airlines (SIA) booking records have been affected by a data breach at the carrier’s reservation-technology provider, Amadeus.
In a media reply on Nov 3, an SIA spokesperson said that data illegally accessed by a third party included customers’ names, booking reference numbers, travel itineraries and booking classes.
For about 620 booking records, information including e-mail addresses, phone numbers, travel document details, and KrisFlyer membership numbers may have been accessed, the spokesperson added.
However, Amadeus has confirmed that bank account or credit card information has not been exposed, and no booking has been modified, SIA said.
The incident was confined to Amadeus’ platform, and the global travel technology provider, which supports certain SIA reservations and booking processes, has told SIA that containment measures and additional security safeguards have been implemented following the breach, the airline said.
SIA added that the incident did not involve a breach of its IT systems.
As a precaution, SIA said, it is directly contacting affected customers with upcoming travel plans to change their booking reference numbers.
SIA said it has also informed the relevant authorities about the matter.
“SIA sincerely apologises to affected customers for any inconvenience caused,” the spokesperson said.
“The protection of our customers’ personal data is of utmost importance to SIA.”
SIA joins a growing list of airlines that have reported customer data being compromised in the Amadeus breach. These include Malaysia Airlines, Cathay Pacific Airways, Japan Airlines, Korean Air and Asiana Airlines.
In recent days, the airlines have said that the breach may have affected information processed between August 2023 and September 2026.
Cathay has reported 53,000 affected bookings, while Japan Airlines has reported 92,000 customer records exposed.
The latest incident is reportedly the third data breach that has affected SIA since February 2021, when 580,000 members of the carrier’s KrisFlyer and PPS programmes had their membership numbers, tier status, and in some cases membership names compromised.
The data breach had originated from air transport information technology firm Sita, whose passenger service system servers were compromised.
A year later, in 2022, SIA’s in-flight retailer KrisShop was targeted in a phishing attack, where data of 4,749 customers was exposed. Personal data exposed included names, e-mail addresses, residential addresses, contact numbers and KrisShop e-voucher numbers.
The bank account numbers of about 165 customers, as well as the KrisFlyer account numbers of 17 people, were also exposed.
The Straits Times has contacted the Cyber Security Agency of Singapore and the Personal Data Protection Commission for more information on the latest breach.