Details in about 46,000 Singapore Airlines booking records were accessed through a flaw at Amadeus, potentially giving scammers material for credible flight messages even though SIA said no bookings had been modified.
The records included passengers’ names, booking references, itineraries and booking classes, SIA said. About 620 records may also have exposed passenger email and phone contacts, travel-document information and KrisFlyer membership numbers, the airline said. EconoTimes previously reported on the affected SIA booking records.
Cybersecurity experts interviewed by CNA said those details could help scammers tailor phishing messages around a real journey, including false cancellation or schedule-change alerts. Such messages could be used to solicit account credentials or card details, the experts said. Dr Bernard Tan, a consultant from Protiviti Singapore, told CNA, “Accurate booking details are not proof that a message is genuine.” Experts suggested passengers reach airlines through their official site or app, or a published support channel, and check upcoming trips for unauthorized changes. No use of the accessed SIA data in fraud has been confirmed.
A separate Cebu Pacific case in the Philippines offers context on booking changes. The Philippine National Privacy Commission’s resolution records 678 changes in that incident: 332 attributed to anonymous users and 346 to system updates. Cebu Pacific reported no confirmed fraudulent booking modifications as of May 24, 2018. The Commission closed the matter Feb. 22, 2023.
SIA said in a Nov. 3 media statement, reported by CNA, that its own IT systems were not breached. It said Amadeus had confirmed no reservations were altered and that the airline was contacting customers with upcoming travel to replace their booking references.
Amadeus linked the incident to a software flaw in a booking display tool. In an October 2026 statement, the company said it had repaired the issue and stepped up monitoring. It also said its review was continuing and that it had found no evidence payment or financial information was accessed.
