Thailand orders tighter aviation cyber security after data breaches across Asia
Thai Airways reported that another 376 records may include passport and contact details, while credit card data was unaffected.
- Thailand's Transport Ministry has ordered all aviation agencies and service providers to strengthen their cyber security, including tightening access controls and improving password management.
- The directive was prompted by a data breach at Thai Airways where approximately 60,529 passenger booking records were potentially accessed through its third-party technology provider, Amadeus.
- The Thai Airways incident is part of a wider series of breaches affecting at least six other major Asian airlines, including ANA, Cathay Pacific, and Singapore Airlines, all linked to the Amadeus system.
- The compromised data included passenger names, booking details, and travel information, but Thai Airways confirmed that credit card and financial information were not affected by the breach.
Thailand’s Transport Ministry has instructed aviation agencies and service providers holding personal data to strengthen cyber security after Thai Airways disclosed on November 9, 2026, that approximately 60,529 passenger booking records may have been accessed without authorisation through its supplier’s system.
Thai Airways confirmed that the incident did not affect its own systems or operations, or passengers’ credit card information. The disclosure comes amid reports of similar incidents involving airlines across Asia that use travel technology provider Amadeus.
Transport Ministry orders stronger access controls
Deputy Transport Minister Siripong Angkasakulkiat instructed agencies involved in aviation, along with service businesses maintaining public databases, to tighten security, change access passwords regularly and avoid passwords that could be easily guessed.
“Although the Thai Airways incident involved an attack on a private company’s system, the Transport Ministry has instructed all agencies to tighten protection of stored public data,” Siripong said.
“Agencies have also been ordered to strengthen security around access credentials and adopt technology to detect wrongdoing,” Siripong added.
Siripong stated that the National Cyber Security Agency (NCSA) was monitoring threats and working to prevent malicious access. Government measures also covered investigations and legal action against people who unlawfully accessed personal information.
The Ministry of Digital Economy and Society had described the wider cyber incidents as unprecedented in scale. The government was preparing a coordinated response involving the National Security Council and the NCSA.
CAAT reports incidents involving six other Asian airlines
The Civil Aviation Authority of Thailand (CAAT) received information about unauthorised access involving Amadeus, which provides reservation and passenger-service systems to airlines worldwide.
CAAT identified six other airlines affected by incidents involving the provider:
- All Nippon Airways (ANA), Japan
- Asiana Airlines, South Korea
- Cathay Pacific, Hong Kong
- Japan Airlines, Japan
- Malaysia Airlines, Malaysia
- Singapore Airlines, Singapore
Cases involving the shared reservation system had emerged across several airlines over the preceding week, with Thai Airways the latest carrier identified in its report.
CAAT instructed Thai Airways to contact affected passengers promptly about changing their login passwords and to amend relevant travel-booking details, such as ticket numbers, to improve passenger protection.
Unauthorised access had been blocked and no further data leakage detected. The report attributed to CAAT assurances that neither credit card nor other financial information had been compromised.
Thai Airways identifies two groups of potentially affected records
Thai Airways’ November 9 notice described unauthorised access to booking data held by Amadeus IT Group S.A., its passenger-service system provider, and cited a period from August 10, 2023, to September 23, 2026.
Thai Airways’ preliminary assessment identified approximately 60,529 passenger records that may have been accessed. The information comprised passenger names, booking references, known as PNRs, travel dates, flight routes and cabin classes.
Thai Airways reported that approximately 376 additional records could involve more information alongside those booking details. These included email addresses, telephone numbers, passport numbers, nationalities, frequent flyer membership numbers, flight numbers, ticket numbers, seat numbers and other related information.
Thai Airways stated that, as of its November 9 notice, it had found no evidence that the information had been disclosed.
Amadeus revokes credentials as Thai Airways investigates
Amadeus revoked the login credentials used to gain unauthorised access and reset all affected passwords, according to Thai Airways. Amadeus also strengthened monitoring, detection and surveillance measures to prevent a recurrence.
Thai Airways confirmed that it had notified the relevant regulators and stressed the importance it placed on protecting personal data.
Thai Airways is continuing its investigation, including a detailed examination of the information supplied by Amadeus. Affected passengers will be contacted individually once the airline has verified the relevant details.
