Thailand tightens aviation cybersecurity after 60,000 passenger data breach

Detailed summary

Thailand has ordered aviation agencies and service providers holding personal data to strengthen cybersecurity following a series of data breaches involving airlines across Asia, including Thai Airways.

The National Cyber Security Agency is monitoring potential threats and working to prevent unauthorized access.

The government is preparing a coordinated response involving the National Security Council and cybersecurity authorities, with investigations and legal action planned against those responsible for unlawfully accessing personal information.

The measures follow Thai Airways' announcement on Nov. 9 that some 60,529 passenger booking records may have been accessed without authorization through the system of Amadeus IT Group, its reservation and passenger-service technology provider.

The airline said the incident did not affect its own systems or flight operations, or passengers' credit card and financial information.

However, the potentially accessed booking records contained a range of personal and travel details, including passengers' names, booking reference numbers, travel dates, flight routes and cabin classes, according to Thai Airways.

Around 376 passenger records may have contained additional personal information, including email addresses, telephone numbers, passport numbers, and nationalities, it said.

Six other airlines reported similar incidents involving Amadeus: All Nippon Airways and Japan Airlines of Japan, Asiana Airlines of South Korea, Cathay Pacific of Hong Kong, Malaysia Airlines, and Singapore Airlines.

The hacked booking data was stored by Amadeus between Aug. 10, 2023, and Sept. 23, 2026.

Thai Airways said it has found no evidence that the stolen information has been made public.

Opening of the article, excerpted from VnExpress International. To read the rest, open the article on the publisher's site.