Amadeus Breach Exposes Data From 46,000 Singapore Airlines Bookings

Singapore Airlines said on Tuesday (3rd) that around 46,000 booking records may have been affected by a security incident at Amadeus, the company that provides the booking technology used by the airline. The information was disclosed by the airline itself and reported by Reuters.

Amadeus is one of the world's largest global distribution systems (GDS), used by dozens of airlines, travel agencies, and corporate travel systems in different countries, including providers that serve the Brazilian market. It is this kind of shared infrastructure, used by multiple customers at the same time, that makes a single flaw capable of affecting passengers from different airlines and continents all at once.

What Leaked, According to Singapore Airlines

The Singapore-based airline said the data exposed in the breach includes customer names, booking reference numbers, travel itineraries, and booking classes. For a smaller subset of approximately 620 booking records, the exposure was more extensive.

In these 620 cases, email addresses, phone numbers, travel document details, and KrisFlyer frequent flyer program numbers may also have been accessed. Amadeus confirmed to Singapore Airlines that banking and credit card data were not leaked, and that no bookings were modified during the incident.

Singapore Airlines said it is contacting affected customers who have future trips booked to change their booking reference numbers as a precautionary measure. The company also made a point of noting that its own IT systems were not breached: the point of entry was Amadeus's infrastructure, not the airline's.

It Wasn't Just Singapore Airlines

The Singapore-based carrier's case adds to a growing list of airlines that have reported customer data compromises linked to the same Amadeus breach. According to Reuters, the following have already reported incidents:

• Cathay Pacific Airways (Hong Kong), with around 53,000 bookings affected;
• Japan Airlines, with approximately 92,000 customers affected;
• Asiana Airlines (South Korea);
• Malaysia Airlines, which said part of its customers' information may have been affected.

The numbers vary widely between airlines, ranging from the tens to more than 90,000 records, which suggests that the breach's actual impact depends on how each airline uses the Amadeus platform and what data it stores there.

What Amadeus Has Said So Far

Amadeus publicly confirmed that it became aware of a vulnerability affecting a "travel booking display environment." However, the company did not respond to Reuters' question about how many customers, in total, had data affected by the incident.

This lack of a consolidated number is significant: each affected airline is disclosing its own totals independently, which makes it difficult to gauge the breach's real scope while Amadeus has not published a unified assessment of the incident.

What This Means for Those Building on Third-Party Platforms

For those who develop or maintain systems that depend on external providers (whether a travel GDS, a payment gateway, or any partner API), this case is a direct reminder of a structural risk: your product's security is only as strong as the weakest link in your supplier chain.

Singapore Airlines was able to confidently state that its own systems had not been compromised precisely because the architecture clearly separates what is operated internally from what is delegated to Amadeus. This separation of responsibility is what allows the incident to be investigated, communicated, and mitigated without the airline having to claim a breach that did not happen in its own infrastructure, though it does not exempt the company from dealing with the reputational damage and the work of notifying customers.

In Brazil, airlines and travel agencies that operate with international GDS platforms such as Amadeus, Sabre, or Travelport depend on the same model: passenger data flows through third-party systems that are rarely auditable by the platform's end customer. Security and engineering teams that integrate this kind of service would do well to review service-level agreements (SLAs) regarding mandatory incident disclosure, and to explicitly map which sensitive data flows through each external provider, before a notice like Singapore Airlines' reaches their own users too.

What Remains Unclear

As of this writing, Amadeus has not publicly detailed the root cause of the vulnerability in the booking display environment, nor has it confirmed a total number of customers affected across all the airlines that use its platform. There is also, based on available information, no indication of when the vulnerability was actually fixed.

Meanwhile, more airlines that use Amadeus's services may come forward with their own numbers in the coming days, as has already happened in staggered fashion with Cathay Pacific, Japan Airlines, Asiana, and Malaysia Airlines.