If you've flown Thai Airways recently, your booking details may have been caught up in a data security incident. The airline confirmed on 9 November that it is investigating unauthorized access to passenger booking information held by Amadeus, the tech company that runs its passenger service systems. Around 60,529 records could be affected.
Here's what was potentially exposed: passenger names, booking references, travel dates, routes and cabin classes — enough for someone to piece together where and when you flew, though not much more. A smaller batch, roughly 376 records, may contain richer details such as passport numbers, nationalities, phone numbers, email addresses and frequent flyer membership numbers, possibly along with flight, ticket and seat numbers. The airline hasn't said how many individual travellers are represented by those records.
The accessed data sat in Amadeus systems covering bookings made between 10 August 2023 and 23 September this year. Amadeus itself flagged the unauthorized access to Thai Airways and has since revoked the login credentials used, reset affected passwords and tightened its monitoring. Thai Airways reported the incident to the authorities and says individual notifications will go out to affected passengers once it has verified the details.
There are a couple of genuine reassurances. Credit card information was not affected, the airline's own systems and flight operations were untouched, and as of 9 November it had found no evidence the information had actually been leaked or misused. That last point comes with a caveat: no evidence of disclosure is not the same as confirmation that nothing was accessed beyond what's known.
For anyone who has booked with Thai Airways in the past couple of years, the practical takeaway is straightforward. Watch for an official notification from the airline — but be alert to phishing, since scammers often pose as companies during breach notifications. Real communications shouldn't ask you for passwords, payment details or passport scans. If your frequent flyer number was involved, consider changing that account password and enabling two-factor authentication. And keep an eye on your email for unusual messages, since booking references plus contact details are exactly the combination fraudsters use to send convincing fake itinerary or refund scams.
The incident is a reminder that when you book a flight, your data lives with third-party tech providers as well as the airline itself — a chain that's only as secure as its weakest login.
