In early November, Thai Airways told its passengers that the booking records of about 60,529 of them may have been read by someone without permission, though the intrusion happened not in the airline's own walls but in the systems of Amadeus, the outside firm that keeps its reservations running. It is a familiar modern story: a trusted supplier becomes the door, and the people whose travel plans were stored there are left to wait for certainty. Thailand's transport authorities have answered by asking every agency that holds public data to guard it more carefully, while the investigation contin
Thailand Tightens Aviation Cyber Rules After Thai Airways Breach Tied to Amadeus Supplier
Booking records of about 60,529 passengers may have been accessed, with about 376 records possibly exposing passport numbers, contact details and other personal information.
Thai Airways' own systems were not touched; its supplier's were.
Mark
Why does a breach at a supplier lead a transport ministry to order changes across the whole sector?
Mimi
Because the supplier is shared. Amadeus provides reservation systems to airlines worldwide, and seven carriers in Asia have now been tied to incidents involving it. Siripong's point was that even though this was a private company's system, public data stored by agencies needs the same protection.
Mark
What exactly might have been exposed?
Mimi
For about 60,529 passengers, names, booking references, travel dates, routes and cabin classes. For about 376 records, possibly more: passport numbers, emails, phone numbers, ticket and seat numbers.
Luke
Let me separate what's confirmed from what's claimed. The 60,529 figure is Thai Airways' preliminary assessment, not a final count.
Mimi
Right, and the airline says "may have been accessed," not "was."
Luke
Same with the reassurances. No evidence of disclosure is Thai Airways' statement as of Nov 9. That's absence of evidence found so far, not proof nothing leaked.
Mark
And the credit card point?
Mimi
Thai Airways says cards weren't affected, and CAAT's report is attributed with the same assurance. Both come from the parties involved.
Luke
Also worth noting the access window runs from Aug 2023 to Sept 2026. That's a long span, and the reporting doesn't say how the credentials were obtained.
Mark
What happens next?
Mimi
Thai Airways keeps investigating and will contact passengers individually after verifying details, while the NCSA and National Security Council prepare a coordinated response.
Luke
Which means the full scale is still unknown.
O Pulso
- Roughly 60,529 Thai Airways passengers may have had their booking records accessed without authorisation, through a third-party supplier rather than the airline's own network.
- About 376 records could also expose passport numbers, email addresses and phone numbers, raising the stakes for the most exposed travellers.
- Six other Asian carriers, including Singapore Airlines and Cathay Pacific, found themselves caught in the same Amadeus-linked intrusion, widening the alarm across the region.
- Amadeus revoked the compromised credentials and reset passwords, while Thailand's ministry ordered stricter password rules and detection tools across aviation agencies.
- Investigators are still verifying details, and affected passengers will be contacted one by one, so the full picture of who was touched remains unsettled.
In early November, Thai Airways told its passengers that the booking records of about 60,529 of them may have been read by someone without permission, though the intrusion happened not in the airline's own walls but in the systems of Amadeus, the outside firm that keeps its reservations running. It is a familiar modern story: a trusted supplier becomes the door, and the people whose travel plans were stored there are left to wait for certainty. Thailand's transport authorities have answered by asking every agency that holds public data to guard it more carefully, while the investigation continues and the affected travellers are still waiting to hear what, exactly, was taken.
On November 9, Thai Airways published a notice saying that booking data for about 60,529 of its passengers may have been accessed without authorisation. The breach did not occur inside the airline's own network. It happened at Amadeus IT Group, the company that supplies the airline's passenger-service system.
The notice described what might have been seen. For most of the affected passengers, the exposed information could include names, booking references, travel dates, flight routes and cabin classes. For about 376 records, the risk reached further, potentially including email addresses, phone numbers, passport numbers, nationalities and frequent flyer numbers. The unauthorised access window ran from August 2023 to September 2026. The airline stressed that its own systems were untouched and that no credit card information was involved, and it had found no evidence that the data had been disclosed.
The problem was not confined to Thailand. Aviation authorities identified six other airlines affected by incidents tied to Amadeus, which serves carriers around the world. Amadeus revoked the credentials used in the intrusion, reset affected passwords and strengthened its monitoring, and Thai Airways notified its regulators.
The government then moved to tighten things at home. Deputy Transport Minister Siripong Angkasakulkiat ordered aviation agencies and public data custodians to change passwords regularly, avoid easily guessed ones, and adopt systems that can detect wrongdoing. The National Cyber Security Agency is monitoring threats, and legal action is being pursued against those who unlawfully accessed personal data.
For now, Thai Airways is still examining what Amadeus has provided, and passengers will be contacted individually once the details are confirmed. The next thing to watch is the coordinated response being prepared with the National Security Council and the cyber agency.
On Nov 9, Thai Airways published a notice telling the public that booking data belonging to about 60,529 of its passengers may have been accessed without authorisation. The breach did not happen inside the airline's own network. It happened at Amadeus IT Group, the company that supplies Thai Airways with its passenger-service system.
Within days, Thailand's Transport Ministry acted. Deputy Transport Minister Siripong Angkasakulkiat told aviation agencies, and the service businesses that maintain public databases, to tighten their security. His instructions were specific: change access passwords regularly and avoid passwords that are easy to guess. He also said agencies must strengthen protection around access credentials and adopt technology that can detect wrongdoing. The Thai Airways case involved an attack on a private company's system, he said, but the ministry wanted all agencies to tighten protection of the public data they store.
The notice laid out what was exposed. For the roughly 60,529 passengers, the records may have included names, booking references known as PNRs, travel dates, flight routes and cabin classes. For about 376 additional records, the airline said more could be involved: email addresses, telephone numbers, passport numbers, nationalities, frequent flyer membership numbers, flight numbers, ticket numbers and seat numbers. The notice put the period of unauthorised access between Aug 10, 2023, and Sept 23, 2026.
Thai Airways said its own systems and operations were not affected, nor was passengers' credit card information. As of the Nov 9 notice, it said it had found no evidence that the data had been disclosed. The Civil Aviation Authority of Thailand (CAAT) also reported assurances that neither credit card nor other financial information had been compromised, that the unauthorised access had been blocked, and that no further leakage had been detected.
Thailand was not alone. CAAT said it had received information about unauthorised access involving Amadeus, which supplies reservation and passenger-service systems to airlines worldwide. It identified six other airlines affected by incidents tied to the provider: All Nippon Airways, Asiana Airlines, Cathay Pacific, Japan Airlines, Malaysia Airlines and Singapore Airlines. Cases involving the shared reservation system had surfaced across several carriers over the preceding week, and Thai Airways was the latest to be identified.
According to Thai Airways, Amadeus revoked the login credentials used to gain access and reset all affected passwords. It also strengthened its monitoring, detection and surveillance measures to prevent a recurrence. Thai Airways said it had notified the relevant regulators. CAAT, for its part, told the airline to contact affected passengers promptly about changing their login passwords and to amend relevant travel-booking details, such as ticket numbers, to better protect them.
The government's response extends beyond aviation. Siripong said the National Cyber Security Agency (NCSA) was monitoring threats and working to prevent malicious access, and that government measures also covered investigations and legal action against people who unlawfully accessed personal information. The Ministry of Digital Economy and Society had described the wider cyber incidents as unprecedented in scale, and the government was preparing a coordinated response involving the National Security Council and the NCSA.
Thai Airways is continuing its investigation, including a detailed examination of the information Amadeus supplied. Affected passengers will be contacted individually once the airline has verified the relevant details. The coordinated government response is the next thing to watch.
Citações Notáveis
Although the Thai Airways incident involved an attack on a private company's system, the Transport Ministry has instructed all agencies to tighten protection of stored public data.— Siripong Angkasakulkiat, Thailand's Deputy Transport Minister
Quer a matéria completa?
Leia o original em The Straits Times ↗
Politics & Governance