Security News Finnair Says 116,000 Reservations Have Been Compromised in Massive Data Breach

[Brownie2019]

Content source

https://www.paddleyourownkanoo.com/2026/11/09/finnair-says-116000-reservations-have-been-compromised-in-massive-data-breach/

Finnair has revealed that at least 166,000 reservations have been compromised in a massive data breach connected to a third-party software vendor that supplies the Helsinki-based airline with its booking and flight management systems.

The Finnish flag carrier is now the seventh major global airline to have come forward as a victim of the data breach at Amadeus, in which passenger names, booking reference numbers, travel itineraries, and booking classes have been illegally accessed.

The data breach is believed to have taken place over more than a three-year period between August 2023 and September 2026. Amadeus did not, however, start informing airlines that they had been caught up in the breach until late October.

Amadeus is one of the world’s largest suppliers of airline technology solutions, which counts more than 130 airlines as customers of its Altéa flagship product, which is a full-service passenger technology platform.

Many of the processes passengers use, like booking a flight on an airline’s website, managing a booking, or checking in for a flight, run in the background on Amadeus Altéa.

“We have demanded detailed clarification of this incident from Amadeus,” commented Finnair’s chief information security officer, Timo Arndal, on Monday. “A detailed investigation is still ongoing, but Amadeus has already confirmed to us that credit card numbers or passwords have not been accessed. Finnair systems have not been compromised.”

Arndal says that while 166,000 reservations have been compromised, only around 750 have been opened for detailed examination. The airline further added that “only a fraction of the examined reservations are active, and Finnair has given new reservation numbers for those to prevent unauthorised access.”

The other airlines that have so far come forward as being caught up in the Amadeus data breach are:

Singapore Airlines (46,000 compromised reservations)
Cathay Pacific (53,000 compromised reservations)
ANA All Nippon Airways (37,800 compromised reservations)
Japan Airlines (92,000 compromised reservations)
In addition, Korean Air and Germany’s Condor have also admitted to being victims of the data breach, although neither revealed the extent of the information accessed.

Amadeus has taken action to ‘mitigate’ the breach and carried out a password reset to lock out nefarious actors.

Airlines have been on high alert for potential cyber breaches since early 2025, when security experts warned that hackers like the infamous Scattered Spider (also known as Muddled Libra) were attempting to gain illegal access to secure airline databases.

Hackers don’t necessarily use lines of code to break into secure systems as you might see in the movies, and are instead employing ‘social engineering’ scams to trick IT support desks into giving them legitimate login credentials to a company’s computer systems.

With access to booking data and a passenger’s email address, hackers could use the information to attempt a phishing scam.

This is where scammers send their victims an email that looks like it came from the airline or another legitimate company. Phishing scams normally try to get victims to click on a link within the email that will usually do one of two things:

Clicking the link will install malware on the victim’s computer, which can then be used by hackers to view sensitive information like bank login data.
Or it will redirect victims to a fake website designed to look like the airline’s own site, where passengers hand over personal details, which can then be used by the fraudsters.
Finnair says it will contact affected passengers by email, and the airline has already informed the National Cyber Security Center in Finland about the breach.

 

[Bot]

Hi Brownie2019 — there is an important numerical error in the quoted article. Finnair’s official figure is approximately 116,000 reservations, not 166,000, so the thread title is correct. Reservations also do not equal unique passengers: one booking can contain several passengers, while one passenger can have several bookings.

The Finnair statement adds some useful nuance:

• About 116,000 reservations appeared in the affected flight lists.
• Approximately 750 reservations were opened for closer examination.
• Only a fraction of those were still active, and Finnair assigned them new booking references.
• Based on the investigation so far, payment details and passwords were not accessed.
• This was an Amadeus incident; Finnair says its own systems were not compromised.

That does not make the exposed reservation data harmless. Names, booking references and travel details can support very convincing “flight cancelled,” “refund available” or “payment required” phishing. Anyone contacted should open the Finnair app or type the website address manually rather than following an email or text link. There is no evidence-based reason to replace a payment card or reset a Finnair password solely because of this breach, unless Finnair’s individual notice says otherwise or the customer entered those details on a suspicious site.

One correction to the article’s phishing explanation: clicking a link does not ordinarily install malware by itself. It may open a fake login/payment page, initiate a download, exploit an unpatched browser, or present ClickFix-style instructions asking the victim to run a command. A genuine CAPTCHA will not ask someone to press Windows+R, paste a command and execute it. The execution step—not merely opening Run or viewing the page—is the particularly serious boundary.

Sources

• ClickFix and fake CAPTCHAs asking for Windows + R
• Finnair customer data included in global Amadeus data breach - Finnair