In this article:
A passenger data leak may have affected Thai Airways bookings: the carrier reported possible unauthorized access to records through the system of Amadeus. The official statement was published on November 9, 2026. According to the airline’s preliminary estimate, outsiders may have gained access to approximately 60,529 records. This does not mean that information about all of these passengers was made publicly available or that each record corresponds to a separate person.
Current as of November 2026. The carrier said bank card data remains secure, and the aviation regulator has not reported any impact of the incident on flight safety. However, travel details can attract scammers: passengers should be more careful with unexpected messages about bookings, refunds and ticket checks. Below are the confirmed details and simple precautions.
What is known about access to bookings
The passenger booking and service system of Thai Airways is provided by Amadeus. This vendor status has been confirmed by the Civil Aviation Authority of Thailand. According to the carrier, the issue concerns possible unauthorized access to data through a partner’s system, not a confirmed breach of the airline’s own IT systems.
As specified in the official Thai Airways statement, published on November 9, 2026, the affected information covers the period from August 10, 2023 to September 23, 2026. The preliminary estimate is approximately 60,529 passenger records that may have been accessed without authorization.
This period describes the data, not the duration of a cyberattack. The statement does not allow the conclusion that outside access continued without interruption throughout this time; the exact dates of individual access to the information have not been established. For context, you can read about another data leak in Thailand · RU, but the events and their scale should not be confused.
Passenger data leak: what information was at risk
According to the outlet Khaosod English, potentially affected bookings may have contained passenger names, booking codes (PNR), travel dates, routes and service classes. This is information that helps link a person to a specific trip, even if payment details were not affected.
The same outlet separately reports on 376 records, which may also have been subject to unauthorized access. Thai PBS, Thailand’s public broadcaster, also reports other possible categories of data: email addresses, phone numbers, passport details, citizenship, loyalty program membership numbers, flight, ticket and seat details.
As of November 2026, it has not been established whether the mentioned 376 records are part of the main estimate of 60,529 or belong to a separate group. These figures should not be added together. For now, the issue is possible access to records, not proven public publication of the entire database.
How the carrier and the aviation regulator responded
According to Thai PBS World, the international service of Thailand’s public broadcaster, the airline assured passengers that their bank card data remained protected. The same outlet reported that Amadeus changed the system’s login credentials.
Separately, Amadeus issued its own statement about an identified vulnerability in the display environment for travel bookings. Based on the investigation described in it, the company found no evidence of access to payment or financial information. Thai Airways is not directly named in this statement, so it cannot be considered independent confirmation of all the circumstances of the incident at the carrier.
Citing the airline, the Thai television channel TNN reported that the incident was not the result of a cyberattack on its own information systems or unauthorized access to them. As of the time of the statement, no unlawful use of passenger information had been detected either. This reflects the results of the check at that time, not a guarantee that no further risks exist.
As stated in a message from Thailand’s aviation regulator, the Civil Aviation Authority of Thailand (CAAT) said it plans to personally notify people whose information was affected. According to information available to the agency, the incident affected neither flight safety nor the airline’s services.
What to do
If you booked a flight with Thai Airways, there is no need to panic. However, a possible leak of booking data is a reason to follow standard digital security measures:
- Check your ticket status through the carrier’s official website or app, opened on your own rather than via a link in an unexpected message.
- Be cautious of emails, calls and messages offering to urgently confirm a booking, receive a refund or update personal information.
- Do not share your booking code, passport details, passwords or one-time verification codes with anyone.
- Do not open suspicious links. For common scam tactics, read about phishing and online fraud schemes in Thailand · RU.
The aviation regulator said it intends to arrange individual notifications but did not specify a timeline or how they will be delivered. If someone contacts you claiming to act on behalf of the airline and asks for personal information, verify the request through the carrier’s official channels.
The investigation’s findings are still preliminary. New details and recommendations may emerge later, so check updates against statements from Thai Airways and the aviation regulator.