Thai Airways Breach: 60,529 Booking Records Exposed via Amadeus

Hackers accessed 60,529 Thai Airways booking records through compromised credentials at technology vendor Amadeus. The airline confirmed the breach on Tuesday after a technical review found compromised entries spanning three years, from August 2023 to September 2026. Thai Airways stated that intruders did not compromise credit card details or payment processing databases.

The numbers matter because they sit in two tiers. The vast majority of exposed files held routine booking data. A smaller pool of 376 records leaked far more sensitive material.

What exactly did the attackers get?

The breach hit Amadeus, the reservation platform that powers flight scheduling, seat reservations and ticketing for major global airline alliances. Criminals exploited credential access to siphon reservation data without ever entering Thai Airways' internal servers, according to the carrier's corporate updates.

The 60,529 exposed files contained standard operational information:

• Passenger legal names
• Passenger Name Record (PNR) codes
• Scheduled departure dates
• Departure and arrival airports
• Reserved cabin tiers

The 376 high-risk files went further. They revealed passport numbers, email addresses, telephone contacts, frequent flyer account numbers, assigned seats and electronic ticket numbers. That is roughly one in every 161 affected records — a small fraction, but a rich one for identity fraud.

What did Amadeus and the airline do?

Amadeus identified the irregular network requests, shut down the affected system account immediately and revoked all active authentication certificates across the platform. The vendor then deployed upgraded security patches and introduced continuous heuristic monitoring across its cloud-based distribution architecture. Technical teams reset all administrative account passwords to block repeat entry attempts.

Thai Airways notified Thailand's personal data regulators and national cybersecurity incident coordination authorities, meeting mandatory disclosure requirements. The carrier committed to contacting affected passengers directly through individualized email notifications outlining protective options.

Note what is absent from the announcement: no timeline for when notifications will complete, no explanation of how the credentials were misused, and no statement on whether the 376 passport-holding passengers face targeted follow-up. Regulators confirmed flight safety controls were unaffected, and scheduled flights continue without cancellations or delays. Operational continuity is not the same as data accountability.

Why should affected passengers act now?

Compromised PNR codes and itineraries are raw material for social engineering. Criminals routinely weaponize them to build convincing spear-phishing campaigns — fake customer service emails demanding phantom cancellation fees or urgent ticket-change confirmations via web links.

Thai Airways never requests emergency wire transfers, debit card verifications or passport uploads through unsolicited messages. Passengers should inspect sender domains carefully and navigate directly to official booking portals rather than clicking email links.

The recommended checklist for anyone who booked during the affected window:

• Monitor email inboxes for spoofed airline communications
• Update loyalty program passwords
• Enable multi-factor authentication
• Review bank records regularly
• Report suspicious booking notifications to law enforcement
• Verify any flight changes through verified airline call centers

Customers can check whether their flights fall within the compromised window through updates published by Bangkok Post and aviation reporting networks.

How serious is this really?

The breach is significant but bounded. No payment data leaked. No internal airline servers were penetrated. The attack relied on misused credentials within third-party reservation architecture, a failure mode that patching and certificate revocation can contain — after the fact. The three-year exposure window is the uncomfortable detail; the intrusion persisted across booking cycles before detection. Third-party dependency remains the operational risk here, and Amadeus's monitoring caught it only after the data was already accessible.