Photo: Reiner Schneider / Pexels
Thai Airways (THAI) announced on 10 November 2026 that passenger data was compromised in a breach of Amadeus, a global travel platform provider. The breach hit Amadeus's reservation system through misuse of account credentials and ran for about three years. Around 60,000 THAI bookings were affected. Most had only names and trip details exposed, while a small number also had contact details and passport numbers. Credit card details were not affected.
What happened
THAI said on Tuesday, 10 November 2026, that passenger data was compromised in a breach of Amadeus. The affected system is Amadeus's reservation system. The breaches involved misuse of account credentials.
The breach period ran from 10 August 2023 to 23 September 2026, about three years.
How many people are affected
The article body says 60,529 THAI bookings were compromised. The sub-headline mentions "50,529 passengers affected", but the body text and the article's web address both point to about 60,000, so the 50,529 looks like a typo. The article also counts bookings in one place and passengers in another, so the two figures may not be identical.
What data was exposed
In all affected bookings, the following was exposed:
- Passenger names
- Reference numbers
- Travel dates
- Flight routes
- Booked seat class
In 376 bookings, more was exposed:
- Email addresses
- Phone numbers
- Passport numbers
- Nationalities
- Mileage membership numbers
- Flight numbers
- Ticket numbers
- Seat numbers
Credit card details were not affected.
What THAI says
THAI says its own systems and operations were not affected. It is still verifying the information it received from Amadeus, and it apologised for the worry and inconvenience.
Other airlines using Amadeus
Several other airlines use the Amadeus system:
- Cathay Pacific
- Malaysia Airlines
- Singapore Airlines
- Japan Airlines
- Korean Air
- Asiana Airlines
- Finnair
The article does not say how many of their passengers were affected, or whether they were breached.
What this means for travellers
These points are our own reading of the situation, not from the article.
- Most of the exposed data is low-sensitivity. Only 376 of about 60,000 bookings (roughly 0.6%) included contact details or passport numbers.
- Phishing is the main risk. Names, routes and travel dates could be used to make fake "your flight changed" emails or texts. Be wary of unsolicited messages about a booking.
- No payment risk has been reported. No card data was taken.
- Passport leaks are the serious ones. If you are told your passport number was exposed, consider contacting your passport authority.
- Other carriers may be affected. If you fly with one of the other listed airlines, or booked through an Amadeus-based agent, watch for notices.
- Check your email. Affected passengers will presumably be contacted by THAI, though the article does not say how.
Information sourced from Bangkok Post.