About 46,000 Singapore Airlines (SIA) booking records were illegally accessed in a data breach at Amadeus, the travel technology company behind some of SIA's reservation and booking processes. SIA confirmed the numbers in a media reply on 3 November 2026, as reported by The Straits Times. SIA says its own IT systems were not breached and that it is directly contacting affected customers who have upcoming travel.
> Quick view: about 46,000 SIA booking records affected · names, booking references, itineraries and booking classes accessed · about 620 records may also include email, phone, travel document and KrisFlyer details · no bank or card data exposed, no booking changed, per Amadeus · SIA contacting affected customers with upcoming travel · report suspicious messages to 1799
What SIA has said
According to the SIA spokesperson's reply, as reported by The Straits Times:
- In about 46,000 booking records, a third party illegally accessed customers' names, booking reference numbers, travel itineraries and booking classes.
- In about 620 of those records, information including email addresses, phone numbers, travel document details and KrisFlyer membership numbers may also have been accessed.
- Amadeus has confirmed that bank account and credit card information was not exposed, and that no booking was modified.
- The incident was confined to the Amadeus platform. Amadeus told SIA it has put containment measures and additional security safeguards in place.
- As a precaution, SIA is directly contacting affected customers with upcoming travel to change their booking reference numbers.
- SIA has informed the relevant authorities and apologised to affected customers.
Why the booking reference matters
On airline websites generally, a booking reference and a surname are what open a trip online. That pair is now in the accessed data for the affected records, which is the likely reason SIA is replacing the references for upcoming trips, although the reply as reported does not spell out the reason.
The more likely risk for most people is a convincing message. A scammer holding your real name, flight and booking reference can write something that looks exactly like an airline notice, such as a "schedule change" or a "fee to keep your seat". This is our own reading, not a warning from SIA, but Malaysia Airlines, which was hit by the same breach, has told its customers to stay alert for unsolicited messages asking for personal or financial details.
What is still unknown
- Dates: the SIA reply as reported does not say when its records were accessed. Cathay Pacific and Malaysia Airlines both give a window of August 2023 to September 2026 for the wider Amadeus incident, so older trips may be involved.
- Past travellers: the reported contact plan covers customers with upcoming travel. It does not say whether people whose trips are already over will be told.
- People affected: 46,000 is a count of booking records, and SIA has not given a number of customers.
- Scoot: the report does not mention SIA's budget arm.
What to do now
- Treat any "SIA" message with care, including one about changing your booking reference. SIA really is sending these, which makes them easy to copy. Do not tap links. Type singaporeair.com yourself and check your trip there, or contact SIA through the details on that site.
- If you have upcoming SIA travel, look at your booking on the official site and confirm the flights and passenger details are what you expect. If your reference changes, use the new one for check-in.
- Be suspicious of any request to pay or to give card details about an existing booking. The report mentions no fee. Knowing your flight number or booking reference proves nothing about who is contacting you.
- KrisFlyer members: review your recent account activity on the official site or app. Passwords are not listed among the accessed data, but changing yours is sensible if you reuse it elsewhere.
- Never share one-time passwords or banking log-ins. Unsure about a message? Call the ScamShield Helpline at 1799. If you have already given out banking details, call your bank immediately and make a police report.
Other airlines caught in the same breach
SIA joins a growing list. The Straits Times names Malaysia Airlines, Cathay Pacific, Japan Airlines and Asiana Airlines among those affected. Cathay Pacific's own notice says about 53,000 of its bookings were involved, that an unauthorised party used login credentials assigned to its system account, and that Amadeus has not so far identified evidence of the data being misused. If you have flown with these carriers, the same care applies.
This is general safety information, not legal or financial advice. Confirm anything about your own booking directly with SIA.
