Amadeus breach: Thai Airways and Finnair say tens of thousands of their bookings were reached

Two more airlines have said their passengers are part of the breach at Amadeus, the company whose software stores and displays bookings for many of the world’s airlines. On November 9, 2026, Thai Airways International (THAI) and Finnair both published statements. THAI counts about 60,529 passenger records and Finnair about 116,000 reservations. Both say card details weren’t affected and their own systems weren’t breached.

Thai Airways: about 60,529 passenger records

In its announcement, THAI says Amadeus told it about unauthorized access to booking data stored in Amadeus systems between August 10, 2023 and September 23, 2026. For about 60,529 passenger records, THAI says the following may have been accessed:

• passenger names
• booking reference (PNR)
• travel date
• flight routing
• cabin class

For about 376 of those records, more may have been included: email address, phone number, passport number, nationality, frequent flyer number, flight number, ticket number, seat number and other related information.

THAI says credit card information was not affected, and that its own systems and operations weren’t impacted. It says Amadeus has revoked the login credentials used in the unauthorized access, reset all affected passwords and added monitoring. THAI has informed the relevant authorities and says it will notify affected passengers individually once it has verified the details. (The Bangkok Post’s report uses the same 60,529 figure in its story, though its subheading says 50,529; THAI’s own notice says about 60,529.)

Finnair: about 116,000 reservations

Finnair’s press release says Amadeus told it the breach involved flight lists of several airlines, including about 116,000 Finnair reservations. Of those, Amadeus says about 750 Finnair reservations “have been opened for examination,” and 30 of those relate to Aurinkomatkat package holidays. Finnair says only a fraction of those are still active, and it has given them new reservation numbers so the old ones can’t be used.

“We have demanded detailed clarification of this incident from Amadeus,” said Timo Arndal, Finnair’s Chief Information Security Officer. Finnair says Amadeus has confirmed that no credit card numbers or passwords were accessed, and that Finnair’s systems weren’t compromised.

Finnair also explains who is responsible for what. Amadeus is the data controller for the affected service, has notified a data protection authority in an EU country under the GDPR, and is responsible for telling the people whose data was involved. Finnair says it will also email customers whose contact details Amadeus has given it, and that you can contact Amadeus directly at dataprotection@amadeus.com. Finnair has also contacted Finland’s National Cyber Security Centre.

How this fits the wider Amadeus breach

This is our fourth story on this breach. In our first story, Japan Airlines, Korean Air and Asiana said someone had used valid login details to reach reservation records. Then ANA, Cathay Pacific and Malaysia Airlines came forward, followed by Singapore Airlines with about 46,000 bookings. THAI’s split looks like theirs: most records show a name, a booking reference and a route, while a few hundred also show contact and passport details.

Each airline only counts its own passengers, which is why the numbers keep coming one statement at a time. Amadeus itself hasn’t published a total.

SAS has since said 350,164 of its passengers were affected, mostly in older bookings. We cover that in a separate story.

What this means for you

If you booked with THAI or Finnair between August 2023 and September 2026, your booking may be in the affected set. A name, booking reference and route are enough for convincing scam messages, and on many airline sites a booking reference plus a surname opens the booking. Nothing either airline has described includes your card number or your account password.

What you can do

1. Watch for a message from THAI, Finnair or Amadeus. If your booking reference has changed, use the new one.
2. Check upcoming bookings yourself in the airline’s app or by typing its web address, not through a link in an email or text.
3. Look at your Royal Orchid Plus or Finnair Plus account for miles redemptions or changes you didn’t make, and make sure the password isn’t used anywhere else.
4. Don’t pay surprise fees or share codes after an unexpected call, email or text that quotes your flight. Knowing your booking doesn’t make a message genuine.
5. Learn the patterns. See how scammers use leaked data to make phishing personal.

How Frame helps

Add this breach to a verified email in Frame and Frame shows what it exposed, gives you a short checklist and counts it in your exposure report. Frame can also look up your verified emails in Have I Been Pwned’s breach database. Frame never collects or stores the leaked records themselves.

Related coverage

• Amadeus breach: airline booking records accessed, including JAL, Korean Air and Asiana: how the breach was found.
• Amadeus breach: ANA, Cathay Pacific and Malaysia Airlines: the second group of airlines to come forward.
• Singapore Airlines says about 46,000 bookings were reached in the Amadeus breach: the third.
• Amadeus breach: SAS says 350,164 passengers had booking details reached: SAS’s count, mostly older bookings with references, dates and passenger counts.

Sources

• Thai Airways International, Amadeus Reports Unauthorized Access to THAI Passenger Data, November 9, 2026
• Finnair, Finnair customer data included in global Amadeus data breach, November 9, 2026
• Bangkok Post, THAI passenger data compromised in Amadeus security breach, November 10, 2026
• Cybernews, Amadeus breach compromises 116,000 Finnair bookings, November 10, 2026