If you have booked with Thai Airways, your booking details may have been seen by someone who should not have had them. The national carrier says booking data held by Amadeus, the company that runs its reservation and passenger service systems, was accessed without authorisation between 10 August 2023 and 23 September 2026, and that about 60,529 passenger records may have been affected.
What was exposed, and what was not
For most of those records, the airline says the data involved was limited to passenger names, booking references (the six-character PNR code on your itinerary), travel dates, routes and cabin class. A much smaller group of about 376 records may also have included email addresses, phone numbers, passport numbers, nationality, frequent flyer numbers, ticket and seat numbers and other booking details.
Thai Airways says card payment details were not affected, and that as of its notice it had found no sign that the data had been disclosed. It also says its own systems and flight operations were not hit, because the access happened inside Amadeus's systems. Amadeus has told the airline that the login credentials used have been revoked, affected passwords reset and monitoring tightened.
Will you be told if you are affected?
The airline says it has reported the incident to the relevant authorities, is still analysing the information Amadeus provided, and will contact affected passengers individually once the details are confirmed. It has not said when those notifications will go out or which routes or booking channels were involved, and its notice does not offer a way to check whether your own booking is affected.
What to do in the meantime
There is no need to cancel bookings or change travel plans. The more practical risk with names, booking codes and routes is that they can make a fake email or call look convincing. Treat any unexpected message about a Thai Airways refund, rebooking or account problem with caution, go to the airline's website or app directly rather than through a link, and never share a password or one-time code. If you hold a Royal Orchid Plus account, changing to a strong, unique password is a sensible precaution. Anyone who receives a notification from the airline should follow the steps it sets out.