Your Booking Code Is a Key: What the Amadeus Breach Means for Asian Air Travellers

Singapore Airlines says about 46,000 of its booking records were accessed without authorisation, and its own systems were not the ones breached. The intrusion happened at Amadeus, the travel technology company whose platform supports part of SIA’s reservations. Cathay Pacific, Malaysia Airlines, Asiana Airlines and Japan Airlines have also said they were affected in recent days.

For most of the SIA records, the exposed data covers names, booking reference numbers, itineraries and booking classes. For about 620 records, email addresses, phone numbers, travel document details and KrisFlyer numbers may also have been seen. No bank or card data was involved, and no bookings were changed. Amadeus has added containment and security measures, and SIA is contacting affected customers with upcoming trips to change their booking references.

Why a six-character code matters

A booking reference plus a surname is often all it takes to open a reservation online. Anyone holding both can see a trip and, on some sites, try to change seats, meals or contact details. Combined with a real itinerary, that same data also makes a very convincing scam email: a message that knows your name, your flight and your travel class feels genuine.

So the practical advice is simple. Accept the new booking reference if your airline offers one. Treat any unexpected message about refunds, rebooking or “verification” with suspicion, and go to the airline’s app or website yourself rather than clicking a link. And remember that one supplier now sits behind many carriers at once, so a single weak point can reach travellers far beyond one airline.