Singapore Airlines said information associated with about 46,000 booking records was accessed in a breach involving Amadeus, the travel-technology provider that supports part of the carrier’s reservation operations. The incident involved unauthorized access by a third party to data stored on Amadeus’ platform, rather than an intrusion into Singapore Airlines’ own information-technology systems.
The exposed information included passengers’ names, booking reference numbers, travel itineraries and booking classes, Singapore Airlines said in a media statement on November 3, 2026. For approximately 620 records, the potentially accessed information was broader and may have included email addresses, phone numbers, travel-document details and KrisFlyer membership numbers.
What information was involved
| Records | Potentially accessed information |
|---|---|
| About 46,000 | Names, booking references, itineraries and booking classes |
| About 620 | Possible email addresses, phone numbers, travel-document details and KrisFlyer numbers |
Amadeus confirmed that bank-account and credit-card information was not exposed. The company also said the unauthorized access did not result in changes to any bookings. Singapore Airlines said Amadeus has taken steps to contain the incident and added security measures after identifying the problem.
“The protection of our customers’ personal data is of utmost importance to SIA,” Singapore Airlines said.
As a precaution, Singapore Airlines is contacting customers with upcoming travel and changing their booking reference numbers. The airline said it has notified the relevant authorities and apologized to passengers affected by the incident. A booking reference can be used in airline reservation systems to identify a passenger’s itinerary, making the carrier’s decision to replace references a precaution aimed at limiting further misuse of the exposed records.
A wider airline technology incident
The disclosure is part of a broader series of airline notifications connected to the Amadeus incident. Cathay Pacific Airways, Malaysia Airlines, South Korea’s Asiana Airlines and Japan Airlines have also said they were affected in recent days. The disclosures indicate that the incident involves data held within a shared travel-technology environment used by multiple carriers, although the information and number of records affected may differ by airline.
- Singapore Airlines said its own IT systems were not breached.
- Amadeus said payment information was not included in the exposed data.
- No bookings were changed as a result of the unauthorized access, according to Amadeus.
- Customers with upcoming travel may be contacted about replacement booking references.
The incident highlights the security exposure created when airlines rely on external platforms for reservation and customer-management functions. Even when a carrier’s internal systems remain intact, information transferred to a technology provider can include details that identify travelers, describe their movements and connect them to loyalty accounts. Singapore Airlines’ statement did not disclose how the unauthorized access occurred, when it began or how many airlines and passengers were affected in total.
