November 9, 2026: Finnair said a data breach at its reservation technology provider Amadeus exposed about 116,000 Finnair bookings. Amadeus told the airline that about 750 of those bookings were opened for examination. Credit card numbers and passwords were not accessed, and Finnair's own systems were not compromised. See the Finnair breach record for details.
The 116,000 figure counts reservations, not people, so the number of travelers may differ. Among the 750 opened bookings were 30 Aurinkomatkat package holidays. Amadeus says the unauthorized activity has stopped.
What happened in the Finnair data breach?
Finnair published the news in English and Finnish notices on November 9 at 15:30 CET. Amadeus told the airline that flight lists for several airlines had been accessed, including about 116,000 Finnair reservations.
"We have demanded detailed clarification of this incident from Amadeus," said Timo Arndal, Finnair's chief information security officer. The investigation is ongoing, and Finnair has contacted Finland's National Cyber Security Center. Amadeus is the data controller for the affected service and has notified an EU data protection authority under GDPR.
Finnair says only a small share of the opened bookings are still active. It has issued new reservation numbers for those trips so the old booking codes cannot be misused.
What data was exposed?
Finnair has not published a list of the data fields involved. It has confirmed that credit card numbers and passwords were not accessed.
Other airlines hit by the same Amadeus incident reported booking references, names, travel dates and routes. Smaller groups of their passengers also had phone numbers, email addresses, passport numbers or frequent flyer numbers exposed. Finnair has not said whether any of these apply to its customers.
Even a booking code and a name are enough for scams. A fake message asking you to pay a baggage fee or rebook a flight can look real when it quotes your actual booking.
Who is affected?
People with Finnair or Aurinkomatkat bookings in the accessed Amadeus flight lists may be affected. Finnair will email customers whose contact details Amadeus provided. Amadeus is responsible for telling affected people, so watch for messages from both companies.
Passengers whose ticket was issued by another airline on a codeshare flight may appear in that airline's notice instead. Being a Finnair Plus member does not by itself mean you are affected, since the notice concerns bookings. More on the airline is on the Finnair company page.
Which other airlines were hit by the Amadeus breach?
Finnair is one of several airlines caught up in the same incident. Japan Airlines reported about 92,000 affected customers, roughly 2,000 of them with passport numbers. Cathay Pacific reported about 53,000 bookings, and Korean Air and Asiana also notified customers.
Malaysia Airlines said customer data processed through Amadeus from August 2023 to September 2026 may be exposed, without giving a count. The airline totals should not be added together, because the same booking can appear in more than one airline's figures. This incident is also separate from the Amadeus iHotelier breach, which involved hotel bookings.
What should Finnair customers do?
- Keep Finnair's email. Compare any later message with it and with finnair.com before you act.
- Never share card details or passwords. These were not exposed, so delete messages that ask you to confirm them.
- Use your new booking code. If Finnair issued one for an upcoming trip, use it at check-in and ignore requests to "unlock" the old one.
- Be wary of rebooking calls. Treat unexpected calls about Aurinkomatkat holidays or flight changes with suspicion unless you started the contact.
- Ask Amadeus directly. Send questions about your data to dataprotection@amadeus.com.
Frequently asked questions
How many Finnair customers were affected?
Finnair says about 116,000 of its reservations were in the Amadeus flight lists that were accessed. That counts bookings, not people, so the number of individual travelers may differ. About 750 bookings were opened for examination, including 30 Aurinkomatkat package holidays.
Were payment cards or passwords stolen?
No. Amadeus told Finnair that credit card numbers and passwords were not accessed. Finnair has not published a full list of the data in the affected bookings. Other airlines in the same incident reported names, booking references and travel details for their passengers.
Was Finnair hacked?
No. Finnair says its own systems were not compromised. The breach happened at Amadeus, which provides reservation technology to many airlines and is the data controller for the affected service. Amadeus has notified an EU data protection authority, and Finnair has contacted Finland's National Cyber Security Center.
When was the Finnair breach disclosed?
Finnair published English and Finnish notices on November 9, 2026, at 15:30 CET. Amadeus says the unauthorized activity has stopped. Finnair has issued new reservation numbers for the small number of affected bookings that were still active and will email customers whose contacts Amadeus provided.