A significant data security incident has potentially exposed the booking details of hundreds of thousands of SAS passengers. According to the airline, a total of 350,164 individuals have been impacted by the breach, which originated within the global travel reservation system Amadeus, an IT platform utilized by numerous airlines around the world.
SAS has formally reported the incident to the Swedish Authority for Privacy Protection (IMY). In a written statement, the airline confirmed that it is aware of the security breach reported by Amadeus and has been notified that specific booking information linked to SAS has been affected. The carrier further noted that it has submitted all necessary reports to the relevant supervisory authorities.
While SAS has not yet notified the affected passengers individually, the airline indicated that this stance remains subject to change should new information emerge regarding the extent or nature of the exposure. The fallout from the incident extends beyond SAS; Finnair has also confirmed that its operations were impacted, with approximately 116,000 of its flight reservations potentially compromised. Finnair stated that the breach encompasses several international airlines beyond its own.
Reports from the Norwegian broadcaster NRK on Friday suggested that unauthorized parties may have maintained access to records within the Amadeus system for as long as three years, with passengers of Norwegian Air also among those affected by the security failure.
