Singapore Airlines has confirmed that about 46,000 of its booking records were accessed without authorisation in a data breach at Amadeus, the reservation technology provider the airline relies on. Singapore Airlines says the breach was confined to Amadeus’ platform and did not involve its own IT systems, and Singapore’s Personal Data Protection Commission (PDPC) is investigating.
Key Takeaways
- About 46,000 Singapore Airlines booking records were accessed through a breach at reservation provider Amadeus, not SIA’s own systems.
- Malaysia Airlines, Cathay Pacific, Japan Airlines and Korean Air have also reported customer data exposure from the same Amadeus incident.
- Arctic Wolf’s Ismael Valenzuela says the breach shows that protecting your own infrastructure is no longer enough to protect customer data.
Other airlines caught up in the same breach
SIA joins Malaysia Airlines, Cathay Pacific, Japan Airlines and Korean Air in reporting customer data exposure tied to the same Amadeus incident. The affected information was reportedly processed between August 2023 and September 2026.
Ismael Valenzuela, Vice President of Threat Research and Intelligence at Arctic Wolf, says the incident shows that a single shared vendor can expose an entire industry even when individual airlines have not been breached directly.
“One of the key lessons from the Amadeus incident is that protecting your own infrastructure is no longer enough to protect your customers’ data. Singapore Airlines has confirmed that its own systems were not breached, yet approximately 46,000 booking records were accessed through a third-party technology provider. Several other airlines have reported similar exposure. This illustrates how a compromise involving a shared service can have consequences across an entire industry, even when individual organisations have not been directly breached.”
No financial data exposed, but phishing risk remains
Valenzuela cautions against underestimating the risk simply because financial information was not exposed. Names, booking references and travel itineraries can still be valuable to attackers, particularly for building convincing phishing campaigns or impersonating airline communications.
“Passengers should be particularly cautious about unexpected booking changes, requests to verify their identity, or messages asking them to follow links,” he said. “Any such communication should be verified directly through the airline’s official channels.”
Third-party risk needs more than an annual checklist
For organisations more broadly, Valenzuela says the lesson is about building a security architecture that accounts for dependencies outside their own environment.
“Third-party risk management cannot be reduced to annual assessments or compliance questionnaires. Organisations need to understand where their sensitive data resides, apply least-privilege principles to trusted integrations, and establish clear expectations for security monitoring, incident notification, and response. Most importantly, they must be prepared to detect and respond when a trusted provider is compromised. You cannot eliminate every third-party risk, but you can design your defences to limit the impact when something goes wrong.”
