Thai Airways reports unauthorised access to passenger records
About 60,529 passenger records and about 376 additional records may have been affected. The airline confirmed that credit card data was unaffected.
- The data breach occurred at Amadeus, Thai Airways' passenger service system provider, involving unauthorized access to booking data between August 2023 and September 2026.
- Approximately 60,529 passenger records were affected, potentially exposing names, booking numbers, and travel details, with an additional 376 records also possibly exposing passport numbers and contact information.
- Thai Airways confirmed that passengers' credit card information was not compromised and that its own systems and operations were unaffected by the incident.
- The provider, Amadeus, has revoked the unauthorized credentials, reset passwords, and enhanced security monitoring to prevent future incidents.
Thai Airways International Public Company Limited issued a statement on Monday (November 9, 2026) after Amadeus IT Group S.A., the provider of its passenger service system, notified it of a cybersecurity incident.
The incident concerned unauthorised access to booking data held in Amadeus’ system between August 10, 2023 and September 23, 2026.
Initial checks indicated that approximately 60,529 passenger records may have been affected.
The information potentially accessed included passenger names, booking reference numbers (PNRs), travel dates, flight routes and cabin classes.
Approximately 376 additional passenger records may also have been affected.
Alongside the information listed above, these records may have included email addresses, telephone numbers, passport numbers, nationalities, frequent flyer membership numbers, flight numbers, ticket numbers, seat numbers and other related information.
Thai Airways confirmed that passengers’ credit card information was unaffected.
The airline added that it had not identified any disclosure of the data as of the date of the statement.
Amadeus confirmed that it had revoked the login credentials used to gain unauthorised access and reset all affected passwords.
It had also strengthened monitoring, detection and surveillance measures to prevent similar incidents.
Thai Airways also stated that the incident had not affected its systems or operations.
The company stressed the great importance it places on protecting personal data and confirmed that it had notified the relevant regulators.
The airline is continuing to investigate the incident, including a detailed analysis of the data and information supplied by Amadeus.
It will contact affected passengers individually once it has completed the necessary checks and confirmed all relevant details.
