Amadeus breach: SAS says 350,164 passengers had booking details reached

SAS has now put its own number on the Amadeus booking-system breach that several airlines have been disclosing for weeks. In a comment to SVT Nyheter published on November 9, 2026, the airline said 350,164 people were affected. The details it describes are narrower than some of the other carriers’ notices. Here’s what SAS has said, and what that means if you flew with them.

What SAS has said

“SAS is aware of the security incident reported by Amadeus and has been informed that certain booking information linked to SAS has been affected,” the airline wrote to SVT.

According to SAS, the leak mainly involves older bookings and completed journeys. The information concerned is “booking references, date details, flight-related information and information about the number of passengers.” SAS told SVT that no “additional categories of personal data” have so far been identified in the leak.

That is a smaller set than some other airlines have described. Thai Airways, for example, said a few hundred of its affected records may also have included email addresses, phone numbers and passport details. SAS is not, at this point, listing those.

SAS has reported the incident to the Swedish Authority for Privacy Protection (IMY) and told SVT it has made the necessary reports to the relevant supervisory authorities while Amadeus’s investigation continues.

Notification, and how the access happened

In its filing, SAS said it has decided not to inform the affected travellers individually. It assesses that the incident does not involve a high risk under the GDPR. SVT reports that this decision can change if new information comes to light.

According to SVT’s account of the filing, an outside party used “compromised system credentials” to get into Amadeus’s booking system, then ran automated searches. That matches what Japan Airlines, Korean Air and Asiana described when they first came forward: someone used valid login details, rather than breaking in through a newly discovered software bug.

SVT also notes that Norwegian had earlier raised the alarm about the intrusion. Norwegian has not, in the sources we reviewed for this story, published a passenger count of its own.

How this fits the wider Amadeus breach

This is our fifth story on the incident. Amadeus has told airlines that unauthorised access to booking-display data took place between August 2023 and September 2026. Thai Airways counts about 60,529 passenger records, Finnair about 116,000 reservations, and Singapore Airlines about 46,000 bookings. Each airline only counts its own passengers. Amadeus itself hasn’t published a total.

What this means for you

If you booked with SAS in the years covered by the Amadeus incident, your booking may be in the affected set, especially if the trip is already over. A booking reference, travel dates and a passenger count are still enough for a convincing scam message, and on many airline sites a booking reference plus a surname opens the booking. Nothing SAS has described includes your card number, password, email or passport details.

What you can do

1. Check upcoming SAS bookings yourself in the airline’s app or by typing its web address, not through a link in an email or text.
2. Don’t pay surprise fees or share codes after an unexpected message that quotes your flight. Knowing your booking reference doesn’t make a message genuine.
3. Watch for a later update from SAS or Amadeus. The airline has said its decision not to email passengers could change if new details appear.
4. Look at your EuroBonus account for redemptions or changes you didn’t make, and make sure the password isn’t used anywhere else.
5. Learn the patterns. See how scammers use leaked data to make phishing personal.

How Frame helps

Add this breach to a verified email in Frame and Frame shows what it exposed, gives you a short checklist and counts it in your exposure report. Frame can also look up your verified emails in Have I Been Pwned’s breach database. Frame never collects or stores the leaked records themselves.

Related coverage

• Amadeus breach: Thai Airways and Finnair say tens of thousands of their bookings were reached: the most recent airline notices before SAS, including a smaller set of records that also included contact and passport details.
• Singapore Airlines says about 46,000 bookings were reached in the Amadeus breach: an earlier carrier count.
• Amadeus breach: airline booking records accessed, including JAL, Korean Air and Asiana: how the breach was found.
• Frontier Airlines is warning customers about fake refund and payment emails: a current airline phishing campaign that asks you to re-enter card details.

Sources

• SVT Nyheter, Misstänkt dataläcka hos SAS – över 350 000 bokningsuppgifter kan ha röjts, November 9, 2026
• The Local, 350,000 SAS passengers may have had details leaked in major data breach, November 10, 2026