Asian airline and bank breaches highlight supplier security risks

Thai Airways’ disclosure that more than 60,000 passenger booking records may have been accessed through Amadeus has highlighted the risks posed by outside technology providers, as airlines and financial firms across Asia report separate cyber incidents.

The cases span reservation platforms, mobile banking and digital securities services, with consequences ranging from exposed personal information to unauthorised payments and suspended services.

Amadeus incident affects several airlines

Thai Airways’ November 9, 2026 announcement identified approximately 60,529 passenger records that may have been accessed through Amadeus. The airline confirmed that its own systems and operations were unaffected.

Singapore Airlines also reported unauthorised access to about 46,000 booking records held by Amadeus, according to CNA. The information included passenger names, booking references and travel details.

Amadeus confirmed that bank account and credit card information was not exposed and bookings were not altered. The provider contained the incident and strengthened security, while Singapore Airlines notified authorities and began contacting affected passengers.

Cathay Pacific, Malaysia Airlines, Asiana Airlines and Japan Airlines were also affected.

Supplier systems come under scrutiny

In Japan, NTT DATA disclosed on November 2 that attackers had breached a software-as-a-service platform operated by contractor Securitize Japan on October 29. They exploited an authentication vulnerability to gain administrator privileges and extract data.

The breach exposed information about 111 bond purchasers and a further 2,678 purchasers. Data concerning the latter group included names written in katakana, quantities of bonds purchased and email addresses.

Sony Bank’s November 4 update identified exposure through the same supplier incident. Four customers’ names, addresses, dates of birth and account numbers were leaked, alongside the names of another 617 customers.

The bank suspended digital securities trading but confirmed that other banking services were unaffected. It found no related unauthorised transactions or evidence that the information had been published online.

Taiwan’s Bank SinoPac reported 427 unauthorised transactions across 419 accounts, totalling NT$41.76 million, approximately THB42.7 million. In its November 4 announcement, the bank attributed the transactions to hackers breaching security settings at suppliers of its mobile banking system.

The bank reported no evidence of a personal-data leak and had reimbursed affected customers.

Malaysia’s Bank Rakyat temporarily restricted access to its corporate website after an attacker using the name MARLANWG defaced it and the iRakyat login page on November 6, Fintech Malaysia reported. The bank maintained that the incident was confined to externally managed websites; internal financial systems, personal data and deposits remained safe.

Earlier in 2026, Malaysia’s central bank fined Bank Rakyat RM1 million, approximately THB7.8 million, for technology risk-management shortcomings following an earlier intrusion. The National Cyber Security Agency was monitoring the latest incident.

Separately, GMO Internet Group reported malware detected in its Onamae.com service on October 20. Its assessment identified a supply-chain attack targeting an internet provider, with potential consequences for businesses using its cloud services.

Korean firms report customer and staff leaks

South Korea’s Mirae Asset Securities disclosed on November 7 that unauthorised access on November 4–5 had exposed account numbers belonging to about 3,800 customers. Information on 35,255 employees, former employees and contractors was also affected, primarily names and staff identification numbers. Email addresses, phone numbers and encrypted passwords were exposed for some employees.

The Financial Services Commission reported on November 5 that 40 breaches at 37 financial companies between September 30 and November 3 had affected about 473,000 records and caused roughly KRW1 billion in financial damage, approximately THB24.6 million.

AI-assisted attacks target payment systems

The Indian Computer Emergency Response Team (CERT-In) issued a November 4 alert about CRAFTY FALCON, a threat actor using artificial intelligence to target non-bank financial companies, digital lenders, fintech firms, payment providers and digital asset businesses.

The agency described attackers using AI to examine targets and conduct attacks, then misusing payment and disbursement application programming interfaces, or APIs, to initiate unauthorised transactions. It confirmed successful attacks had been reported and the campaign remained active.

In a separate case, Reuters reported on November 5 that Indian microlender Spandana Sphoorty Financial had detected cyber fraud involving unauthorised transactions from its bank accounts. The amount and attack method were not disclosed.

Indonesia records 657,000 blocked attempts

FortiGuard Labs detected and blocked 657,000 attack attempts in Indonesia over 24 hours on November 8, equivalent to roughly eight per second.

Kompas reported that banking, financial services and insurance accounted for more than 262,000 attempts, followed by government agencies with 102,000 and manufacturing with 81,000. Kaspersky data placed Indonesia 21st among the countries most frequently targeted at the time.

These figures represent detected and blocked attempts, not successful intrusions. Experts attributed the targeting of banks to the potential financial rewards, while government systems hold strategic information and citizens’ data.

Public services and infrastructure also affected

In the Philippines, attackers reportedly extracted 69 gigabytes of SQL Server backup files associated with the Philippine Overseas Employment Administration in 24 minutes. A cybersecurity company traced the activity through a staging server in Singapore.

The 27 backup datasets contained information on overseas Filipino workers, employment contracts, financial records and bank accounts. Although no direct damage to the original systems was found, the company confirmed a breach because the files had been removed from the agency’s control.

European incidents extended beyond data theft. A French bank reported approximately €100 million missing from transactions involving its own accounts on November 5. Customer accounts were unaffected and prosecutors opened an investigation.

Norway’s Norad disclosed an October 30 attack involving 27 accounts on its Grants Portal. Names and email addresses of 20,614 users may have been accessed, while applications from three organisations were extracted. The portal was shut down and authorities notified.

In France, attackers altered refrigeration settings at three blood plasma storage facilities on November 2. Alarms enabled staff to move blood products to safety, preventing any plasma losses.

Supermarket refrigeration problems were also reported in Belgium, Sweden, the Netherlands, Estonia, Luxembourg, Finland, Ireland, Portugal and Italy, with some damaged goods removed from stores.

Reports from the United States, Germany, Portugal, Argentina, Colombia, Ecuador and Brazil described attacks on public bodies and services involving ransomware, unauthorised file access and website defacement.

Source: Thansettakij