Amadeus Breach Compromises 116,000 Finnair Bookings
Amadeus Breach Compromises 116,000 Finnair Bookings
At least 116,000 Finnair reservations have been compromised in a huge data breach connected to Amadeus, a third-party software vendor that supplies the Finnish airline with its booking and flight management systems. Finnair says Amadeus informed the airline of a data breach involving flight lists of several airlines, including approximately 116,000 Finnair bookings. The data breach is believed to have taken place over a three-year period between August 2023 and September 2026. However, Amadeus, one of the world’s largest suppliers of airline technology solutions, didn’t begin informing airlines that they had been caught up in the breach until late October. “We have demanded detailed clarification of this incident from Amadeus,” said Finnair’s chief information security officer, Timo Arndal.
Amadeus has already confirmed that credit card numbers or passwords have not been accessed. Finnair systems have not been compromised, according to Finnair’s press release. In October, Amadeus stated that it had discovered a vulnerability “affecting a travel booking display environment” and that “certain booking-display data” was accessible through the flaw. The variety of information exposed in the breach included booking references, names, and flight details, as well as passenger email addresses, phone numbers, travel documents, and frequent flyer numbers in a smaller number of cases. Amadeus further told the airline that roughly 750 Finnair reservations “have been opened for examination.” Of these, 30 are related to the airline’s Aurinkomatkat travel packages.
The good news is that the unauthorized activity has been contained. According to Finnair, only a fraction of the examined reservations are still active, and the company has issued new booking numbers for them to prevent potential misuse. Finnair is now the seventh major global airline to come forward as a victim of the data breach at Amadeus. Other airlines caught up in the incident include Singapore Airlines, Cathay Pacific, ANA All Nippon Airways, Japan Airlines, Korean Air, and Condor. Passengers who believe their personal data has been compromised are advised to change their passwords, enable multifactor authentication, and carefully monitor any accounts that could have been exposed.