Thai Airways International has disclosed a potential data breach involving more than 60,000 passenger records after its passenger service system provider, Amadeus IT Group S.A., reported a cybersecurity incident.
In a statement on Monday (Nov. 9, 2026), the airline said the incident involved unauthorized access to booking data stored in Amadeus’ system from Aug. 10, 2023, to Sept. 23, 2026.
Initial checks indicated that approximately 60,529 passenger records may have been affected.
The information potentially accessed included passenger names, booking reference numbers (PNRs), travel dates, flight routes and cabin classes.
READ: Bangkok airport luggage mess: Thai Airways says ‘we offer no excuses’
Approximately 376 additional passenger records may also have been affected.
Alongside the information listed above, these records may have included email addresses, telephone numbers, passport numbers, nationalities, frequent flyer membership numbers, flight numbers, ticket numbers, seat numbers and other related information.
Thai Airways confirmed that passengers’ credit card information was unaffected.
The airline added that it had not identified any disclosure of the data as of the date of the statement.
Amadeus confirmed that it had revoked the login credentials used to gain unauthorised access and reset all affected passwords.
It had also strengthened monitoring, detection and surveillance measures to prevent similar incidents.
Thai Airways also stated that the incident had not affected its systems or operations.
READ: Seven Thai airlines offer free 10kg fruit check-in at 20 airports
The company stressed the great importance it places on protecting personal data and confirmed that it had notified the relevant regulators.
The airline is continuing to investigate the incident, including a detailed analysis of the data and information supplied by Amadeus.
It will contact affected passengers individually once it has completed the necessary checks and confirmed all relevant details. /dl