Thai Airways Breach Exposes 60,000 Records, Triggers Passenger Notification Order

Thailand’s aviation regulator has ordered Thai Airways International to protect affected passengers and provide individual notifications after unauthorized access through Amadeus implicated more than 60,000 booking records. The airline disclosed the intrusion on November 9, saying some records potentially contained passport and contact information even though its internal systems and passenger payment-card data remained unaffected.

The known scope has two parts. Approximately 60,529 records contained passenger names, booking references, travel dates, routes and cabin classes. Another 376 records potentially included more extensive information, such as passport numbers, nationalities, telephone numbers, email addresses and frequent-flyer membership numbers. Thai Airways did not say that every data category appeared in every one of those records.

If the groups are separate, the incident implicated about 60,905 records. That figure is not a passenger count: one traveler can generate multiple bookings, while one booking can cover multiple people. The number of unique individuals affected remains unknown.

The booking dates do not reveal the breach duration

The affected reservations were made between August 10, 2023, and September 23, 2026. That three-year booking window identifies the age range of the records, not how long an unauthorized party had access. Thai Airways has not disclosed the entry method, discovery date, identity of the attackers or access duration.

Those missing facts define the next stage of the investigation. The entry method will help determine whether the incident arose from compromised credentials or another weakness. The discovery date is important for evaluating the response timeline, while the access duration would indicate how long reservation data was exposed to possible collection.

Amadeus revoked credentials associated with the unauthorized access, reset affected account passwords and increased monitoring. These are immediate containment measures, but the longer-term policy issue is whether access privileges, account monitoring and supplier oversight were sufficient before the intrusion was found.

A supplier breach still reaches the passenger

Airline reservations depend on interconnected systems spanning carriers, technology providers and other travel services. That distribution supports global booking and passenger processing, but it also means an airline’s internal network can remain secure while passenger information held or processed elsewhere is accessed.

The distinction between operational safety and privacy impact is important for system governance. Thai Airways and the Civil Aviation Authority of Thailand said flight operations and passenger services continued normally and aviation safety was unaffected. The airline also said credit-card information was not involved and it had no evidence that the accessed data had been publicly released. No fraud linked to the incident has been confirmed.

Passengers can still face a meaningful loss of control over their information without payment data or an operational disruption. Names combined with booking references, routes and travel dates can describe where and when a person traveled. For the smaller group of records, passport numbers and contact details raise the sensitivity because they connect itinerary information with stronger identity markers.

This is why aviation cybersecurity policy extends beyond aircraft and an airline’s directly operated network. The International Air Transport Association’s Aviation Cybersecurity Library includes specific guidance on cybersecurity supply-chain oversight, alongside broader risk-assessment material. The framework reflects a basic systems-integration problem: a carrier remains accountable to passengers even when an external provider operates the affected technology.

Notification is the immediate accountability test

Thai Airways reported the incident to authorities and said it would contact affected passengers after verifying the compromised information. It has not provided a timetable for completing that process. The regulator’s order turns notification from a general response commitment into a specific oversight requirement.

Accurate notices will require more than sending the same warning to everyone associated with the booking period. Travelers need to know whether their record belonged to the larger itinerary-data group or the smaller group that may contain passport and contact details. That creates a tradeoff between speed and precision: waiting for verification can improve the usefulness of each notice, but delay leaves passengers uncertain about what information was accessed.

Thailand’s breach-notification framework allows preliminary and phased reporting as investigations develop. A published explanation of the Personal Data Protection Committee’s guidance notes that controllers assess the type and volume of data, possible harm and remedial measures, while the 72-hour regulatory-notification period begins when there are reasonable grounds to believe a breach occurred. Individual notification and regulatory reporting are related but separate obligations.

The unresolved measure of this incident is therefore not merely the record total. It is whether Thai Airways and Amadeus can establish who was affected, identify the information in each record and deliver useful individual notices while the investigation determines how the external access occurred and how long it lasted.

By Thomas Caldwell — AMI’s senior editor for mechanical and mobility engineering, covering vehicle electronics, systems integration, electrification, chassis systems, propulsion, and safety policy.