Thai Airways is investigating unauthorized access to passenger booking information held by its service provider Amadeus, with around 60,529 records potentially affected, the airline said on 9 November.
The airline will notify affected passengers individually after checking the information supplied by Amadeus. It has reported the incident to the relevant authorities, while its review of the affected records continues.
The information potentially accessed includes passenger names and booking references, alongside travel dates, routes, and cabin classes.
The airline also identified around 376 additional records that may contain more extensive personal details, including passport numbers, nationalities, phone numbers, email addresses, and frequent flyer membership numbers. Flight, ticket, and seat numbers may also be involved.
The figures refer to passenger records. Thai Airways’ statement did not establish how many individual travelers those records represent.
The incident concerns booking data stored in Amadeus systems between 10 August 2023 and 23 September. Amadeus provides the airline’s passenger service systems and informed Thai Airways of the unauthorized access.
Thai Airways said credit card information was unaffected and that its own systems and flight operations had not been disrupted.
Amadeus has since revoked the login credentials used to access the information and reset affected passwords, according to the airline. It has also reinforced its monitoring and detection measures to help prevent further unauthorized access.
As of 9 November, Thai Airways said it had found no evidence that the affected information had been disclosed. That finding remains separate from the unauthorized access under investigation.
The airline apologized to passengers for the concern and inconvenience caused and said individual notifications would follow once it had verified the relevant details.
