# Major Data Breach Exposes Over 350,000 SAS Passenger Records Amadeus booking system vulnerability impacts multiple airlines including Finnair and Norwegian. - **Source:** [SVT – Inrikes](https://www.svt.se/nyheter/inrikes) - **Published:** 2026-11-09 - **Topic:** [technology](https://brifing.si/c/technology) - **Original article:** - **On Brifing:** https://brifing.si/s/3dd930f6-0cbe-4988-83cc-1d99a2d25f9d ## Massive Passenger Data Exposure A significant security incident at IT provider Amadeus has exposed booking details for over 350,000 SAS passengers. The breach involves flight-related information, including booking references, travel dates, and passenger counts. SAS confirmed that 350,164 individuals are affected, though they claim no additional sensitive personal categories have been identified in the leak. ## Wider Industry Impact The security failure extends beyond SAS, affecting other major carriers. Finnair reported that 116,000 of its passenger reservations were potentially compromised. Norwegian has also raised alarms regarding the intrusion. Reports indicate that unauthorized parties may have maintained access to the Amadeus booking system for up to three years, impacting various travel agencies. ## Mechanism of the Breach External actors reportedly utilized compromised system credentials to infiltrate the Amadeus booking infrastructure. Once inside, the perpetrators executed automated searches to harvest reservation data. While SAS notes that the leak primarily concerns older bookings and completed trips, the persistence of this unauthorized access highlights a critical vulnerability within the shared aviation IT ecosystem. ## Regulatory Reporting Status SAS has formally notified the Swedish Authority for Privacy Protection, IMY, regarding the incident. The airline is currently monitoring the ongoing investigation conducted by Amadeus. Despite the scale of the exposure, SAS has decided not to inform individual passengers directly, citing an internal assessment that the risk level does not meet the GDPR threshold. ## Finnair Response Measures In contrast to the SAS approach, Finnair is actively managing the fallout for its 116,000 affected reservations. The airline stated that Amadeus is currently reviewing 750 specific reservations, with only a small number identified as active. Finnair has issued new reservation numbers to these passengers to prevent any further unauthorized access to their travel plans. ## Historical Access Concerns Reports from NRK suggest the security gap may have persisted for as long as three years. This extended window of vulnerability potentially allowed unauthorized parties to access sensitive details across multiple airlines and travel agencies, such as Berg-Hansen. In some instances, the exposed data may have even included passport information for the affected travelers. ## Risk Assessment Discrepancies The decision by SAS to withhold direct notification remains subject to change if new information emerges during the investigation. The airline maintains that the current data exposure does not pose a high risk to individuals under GDPR guidelines. However, the potential for long-term data misuse remains a point of concern for industry security experts. ## Ongoing Investigation Outlook The investigation into the Amadeus system remains active as authorities and airlines work to secure the environment. While the immediate threat to active bookings is being mitigated through new credentials, the long-term implications of the leaked historical data remain uncertain. Stakeholders are now closely watching for further findings from the ongoing security audit. ## Sources covering this story - https://www.svt.se/nyheter/inrikes/misstankt-datalacka-hos-sas-over-350-000-bokningsuppgifter-kan-ha-rojts — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._