Thai Airways International (THAI) has said that about 60,529 passenger records may have been accessed without authorisation in a security incident at Amadeus IT Group, the provider of its passenger service systems.

THAI said in an announcement on November 9 that Amadeus informed it of unauthorised access to booking data stored in Amadeus systems between August 10, 2023 and September 23, 2026.

Based on the investigation so far, the affected information included passenger names, booking reference numbers (PNRs), travel dates, flight routing and cabin class. For about 376 of the records, other details may also have been involved. These include email addresses, telephone numbers, passport numbers, nationality, frequent flyer numbers, flight numbers, ticket numbers and seat numbers.

THAI said credit card information was not affected. It added that, as of the date of the notice, there was no sign the data had been disclosed.

Amadeus has confirmed that the login credentials used in the unauthorised access have been revoked and the affected passwords reset. It has also put monitoring and detection measures in place to help prevent similar incidents, according to THAI.

The airline said the incident did not affect its own systems or operations. It has informed the relevant authorities and is continuing to investigate, including analysing the data provided by Amadeus. THAI said it will notify affected passengers individually once the details have been verified, and apologised for any concern or inconvenience.