Singapore Airlines: about 46,000 booking records accessed in the Amadeus breach, 620 may include travel document details
Singapore Airlines said on November 3, 2026 that about 46,000 of its booking records were accessed in the Amadeus breach — names, booking references, itineraries and booking classes in every record, and for about 620 records also email addresses, phone numbers, travel document details and KrisFlyer membership numbers; its own IT systems were not breached, and Amadeus confirmed bank and card information was not leaked and no bookings were modified.
What happened
We first flagged this on October 28, 2026 — here’s what changed. Update Nov 4, 2026, 08:00 ET: Added Singapore Airlines’ statement of November 3, 2026 — a further airline putting its own count and data types on the same Amadeus incident — and Amadeus’s position, reported by Reuters, that it had become aware of a vulnerability affecting a travel booking display environment. Singapore Airlines said on Tuesday, November 3, that about 46,000 of its booking records may have been affected by the cybersecurity incident at Amadeus, the provider that supports some of its reservation and booking processes. The airline said its own IT systems were not breached and that the incident was confined to Amadeus’s platform; it has informed the relevant authorities.
Singapore Airlines is the latest carrier to confirm its place in this incident. This desk has already reported the same Amadeus breach at Japan Airlines (about 92,000 customers, October 28), ANA (about 37,800 customers, October 30), Cathay Pacific (about 53,000 bookings, October 30) and Malaysia Airlines (no count given, November 1). Amadeus has still not said how many airlines or customers are affected in total.
Who is affected
Singapore Airlines customers in about 46,000 booking records. In every one of those records, the airline said, the data accessed included the customer’s name, booking reference number, travel itinerary and booking class. For about 620 of the records, email addresses, phone numbers, travel document details and KrisFlyer membership numbers may also have been accessed. The airline has not said which travel dates the records cover. Amadeus confirmed to the airline that bank account and credit card information had not been leaked and that no bookings were modified.
How serious
The concrete risk is targeted phishing and booking fraud built on real trip details: a scammer holding a traveller’s name, booking reference and itinerary can pose as the airline about a genuine flight and push a fake change-fee or refund payment. For the roughly 620 records that also included travel document details and KrisFlyer numbers, the exposure goes further — those details can support identity misuse and attempts to reach the frequent-flyer account. Payment data was not involved, on Amadeus’s confirmation to the airline, and no booking was changed.
What to do now
Singapore Airlines says it is directly contacting affected customers with upcoming travel to change their booking reference numbers as a precaution — if you receive that contact, follow it, and complete any change inside the airline’s official website or app, which you open yourself. Treat any other message about a Singapore Airlines booking — especially one asking you to pay a fee, confirm travel document details or sign in through a link — as suspect, and check the booking in the app or on the official site instead. KrisFlyer members in the smaller affected group should also watch their account for unfamiliar activity and be alert to phishing that quotes their real itinerary.
Sources: Reuters, November 4, 2026 · Cyber Security ASEAN, reporting the airline’s November 3, 2026 statement · Original report: Japan Airlines / Amadeus breach (October 28, 2026)