Amadeus booking breach reaches 46,000 Singapore Airlines records as carriers count the damage

The Straits Times reported on 3 November that about 46,000 Singapore Airlines booking records were accessed illegally in the breach at travel technology provider Amadeus. That figure makes SIA one of the largest disclosed victims so far. It lands three days after Cathay Pacific put its own count at 53,000 bookings.

The Bangkok Post reported Cathay's number on 30 October, and IDNFinancials repeated it the same week. Neither carrier has said what fields the attackers reached. Amadeus has not published a technical account of the flaw. The pattern across carriers is consistent: each airline discloses a slice of a shared reservation system it does not control. Cathay's 53,000 and SIA's 46,000 are booking records, not necessarily passengers. The two figures are not directly comparable without knowing how each carrier counts a record. Every disclosure so far leaves out the same thing: which data fields were actually read.

Qantas confirmed it is investigating possible exposure of booking data, according to Airways Magazine on 2 November. Malaysia Airlines told customers they may be affected, the Bangkok Post reported on 1 November. PenangToday and KLSE Screener both carried the airline's statement that its own IT systems were untouched.

That distinction matters: the carrier says the compromise sat with the vendor, not inside its network. Japan Airlines appears in the list of affected carriers in reporting from InfotechLead and others. No booking figure has been published for it. Nine days after the first disclosures, the public accounting is still partial.

Three years, one vulnerability

The most damaging detail is the duration. PYOK reported on 30 October that the breach at the software provider managing bookings for hundreds of international airlines had run for three years. Shattered.io described the flaw as clouding 38 months of airline data. Amadeus has since fixed the vulnerability, according to NST Online, which reported the fix on 2 November.

The company has not explained how the access went undetected for that long. No outlet has published the root cause.

"Vendor cyber risk in focus as Amadeus breach hits airlines globally" ran the headline at Insurance Business on 2 November, which frames the story the way the insurance market is starting to see it.

That framing is not rhetorical. A reservation platform sits between the airline and its customer. It holds passport numbers, contact details and itineraries, and every carrier that connects to it can reach it. When it fails, the failure is not contained to one brand. The carriers that buy from it inherit the exposure without ever holding the data themselves.

What the carriers are telling passengers

Malaysia Airlines warned customers after the breach, according to reporting carried by outlets including VnExpress International and the Bangkok Post. Qantas still described its investigation as preliminary on 2 November, per Airways Magazine. At that point the airline had not confirmed the scope of any exposure. News.com.au reported on 2 November that Qantas and other major airlines had been caught up in the incident. News24 reported the same day that carriers flying in and out of Australian airports were affected.

Business Traveller's 2 November piece addressed the question passengers actually ask: whether their flight details were accessed.

For travellers, the practical advice is unchanged and unglamorous. Watch for phishing that quotes a real booking reference, since that is exactly the data now circulating. Neither Amadeus nor the carriers named here have disclosed how many records in total were reached. Any single number is one airline's count, not the size of the incident. Travel Daily News International reported on 3 November that Paxport and ITT had published a guide on airline connectivity risks. The industry's response is trending toward procurement checklists rather than incident detail.

The unresolved question is contractual. Airlines buy reservation services from a handful of vendors. The SIA and Cathay disclosures show how quickly a single vendor flaw becomes a multi-carrier disclosure event. Amadeus and investigating authorities have not yet published what happened between the first unauthorised access and the fix. Until they do, the 38-month figure remains the most serious fact in the story, and the least explained.