2026 Singapore Airlines — about 46,000 booking records exposed through the Amadeus breach; about 620 with contact and travel-document details

Data compromised

For about 46,000 booking records: names, booking reference numbers, travel itineraries and booking classes. For about 620 records, more details may have been accessed: email addresses, phone numbers, travel document information and KrisFlyer numbers. SIA says card and bank details were not involved and no bookings were changed. The figure counts records, not confirmed individuals.

Technical writeup

Root cause

Amadeus said on October 1, 2026 that it had found a vulnerability in a travel booking display environment. Coverage says unauthorized access ran from August 10, 2023 to September 23, 2026. Amadeus told one carrier that an attacker used login credentials assigned to its system account. Amadeus says there is no evidence that payment or financial data was accessed and no sign the flaw was used for ransomware. Singapore Airlines says its own systems were not affected.

References

• https://www.malaymail.com/news/singapore/2026/11/04/singapore-airlines-booking-data-for-46000-records-compromised-in-amadeus-data-breach-620-had-additional-details-exposed/241931
• https://therecord.media/asian-airlines-announce-data-breach-it-provider-incident