Amadeus Data Breach Exposes 350,164 SAS Travellers in Three-Year Booking Hack

Booking details for 350,164 travellers of Scandinavian airline SAS may have been exposed in a breach of travel-technology provider Amadeus, the largest number any airline has reported so far. SAS disclosed the exposure through Swedish broadcaster SVT on Sunday, November 9, 2026, and has reported the matter to Sweden's privacy regulator, the Swedish Authority for Privacy Protection, known as IMY.

The affected data covers mostly older bookings and completed journeys, and SAS says it has found no evidence so far that payment or financial data was accessed. The Amadeus data breach has widened into one of the biggest airline data incidents in years, with carriers across Europe and Asia confirming that their passengers' booking records were swept up in the same intrusion.

Key Points

• SAS says booking details for 350,164 travellers may have been exposed in the Amadeus data breach, the largest figure reported by any airline so far.
• Norway's National Security Authority says the unauthorised access may have lasted at least three years, from August 2023 to September 2026.
• The exposed data is mostly older bookings and completed journeys, including booking references, dates, flight details and passenger numbers.
• SAS says no evidence has been found that payment or financial data was accessed, and no further categories of personal data have been identified so far.
• Finnair says about 116,000 of its bookings appeared on accessed flight lists and is issuing new booking codes for active bookings.

What Happened

The breach came to light through SAS, which said booking details for 350,164 of its travellers may have been exposed after an external actor gained access to Amadeus systems.

According to the information released so far, the attacker used compromised system credentials to run automated searches of Amadeus booking data. The searches pulled up booking references, dates, flight details and passenger numbers, largely from older bookings and journeys that had already been completed.

The timeline is what has alarmed regulators and the airlines involved. Norway's National Security Authority said on Friday, November 6, that the unauthorised access may have lasted at least three years.

The Amadeus Data Breach: How the Intrusion Worked

The intrusion did not involve breaking into an airline's own systems. Instead, the attacker targeted Amadeus, the technology company that sits behind the booking systems of many of the world's airlines. By using compromised system credentials, the external actor was able to run automated searches across Amadeus booking data.

The weakness was in a booking-display environment, a part of the system that shows reservation details. Once the vulnerability was identified, Amadeus closed it on September 23, 2026, but the access is believed to have begun as early as August 2023, giving the attacker a window of about three years.

Background: Amadeus and the Airlines Caught Up

Amadeus, headquartered in Spain, provides the reservation, ticketing and departure-control systems used by airlines around the world, and it processes hundreds of millions of bookings a year. When a vulnerability opens in its systems, the consequences ripple across the carriers that depend on it, which is why the list of affected airlines keeps growing.

Finnair has said about 116,000 of its bookings appeared on the accessed flight lists, and the Finnish carrier is issuing new booking codes for active bookings as a precaution. Other airlines that have reported an impact include Singapore Airlines, Cathay Pacific, Japan Airlines, ANA, Korean Air, Asiana, StarFlyer, Malaysia Airlines and Condor.

Reactions and What the Airlines Are Doing

SAS has decided not to contact affected travellers individually, judging the risk low under the European Union's General Data Protection Regulation, known as GDPR. The airline said that decision may change if further information emerges from the investigation. The approach reflects the airline's assessment that the exposed data, mostly older bookings without payment details, poses a limited risk.

Finnair has taken a more hands-on approach, issuing new booking codes for active bookings that appeared on the accessed lists. Changing a booking code makes the old reference useless to anyone who might have copied it. Amadeus has said it fixed the vulnerability, enhanced its monitoring and is still investigating.

Why It Matters

The Amadeus data breach matters because it exposes how much of the travel industry depends on a handful of technology providers. A single vulnerability in one supplier's system can expose the booking records of passengers from dozens of airlines, across continents, over a period of years. For the 350,164 SAS travellers and the tens of thousands of Finnair passengers affected, the exposure is real even if the data taken was limited.

Booking details may seem less sensitive than payment card numbers, but they are still valuable to criminals. A booking reference, combined with a name and travel dates, can be used to craft convincing phishing messages that appear to come from an airline.

What Happens Next

Amadeus is still investigating the incident, and the company is expected to share more detail with the airlines and regulators as its review progresses. The number of affected airlines may grow as more carriers complete their checks, and Qantas is among those still working through whether its passengers were caught up in the accessed flight lists.

SAS has said its decision not to contact affected travellers individually may change, and passengers who flew with SAS or the other affected airlines between August 2023 and September 2026 should watch for further announcements.

Frequently Asked Questions

How many SAS travellers were affected by the Amadeus data breach?

SAS says booking details for 350,164 travellers may have been exposed, the largest number reported by any airline so far in the incident.

What data was exposed in the breach?

The exposed data is mostly older bookings and completed journeys, including booking references, dates, flight details and passenger numbers. SAS says no evidence has been found that payment or financial data was accessed.

How long did the unauthorised access last?

Norway's National Security Authority said the unauthorised access may have lasted at least three years, from August 2023 to September 2026. The vulnerability was closed on September 23, 2026.

Which other airlines were affected?

Finnair says about 116,000 of its bookings were on accessed flight lists. Other airlines reporting an impact include Singapore Airlines, Cathay Pacific, Japan Airlines, ANA, Korean Air, Asiana, StarFlyer, Malaysia Airlines and Condor, while Qantas is still checking.

Will SAS contact affected travellers?

SAS has decided not to contact affected travellers individually, judging the risk low under GDPR, but the airline says that decision may change as the investigation continues.

Related coverage: the Marathon Health breach that exposed medical and Social Security data for almost 5.7 million people (Marathon Health data breach exposes 5.7 million people's medical and Social Security data), and the DHS breach that exposed 40,000 employees including ICE agents (DHS data breach exposes 40,000 employees including ICE agents).