The SAS data breach may have exposed booking information linked to 350,164 travellers. The incident involved Amadeus, the airline’s external reservations provider, and potentially affected records include booking references, dates and flight information.
SAS disclosed the incident to the Swedish Data Protection Authority, known as IMY. The airline has assessed the risk as not high and, at the time of reporting, had not decided to notify affected passengers directly.
What happened in the SAS data breach?
The incident became public on 9 November 2026, when SVT Nyheter reported details from SAS’s notification to IMY. According to the filing, booking information associated with 350,164 SAS travellers may have been accessible through systems operated by Amadeus.
SAS said the affected information mainly related to older reservations and completed journeys. The airline reported that an external actor used compromised system credentials to enter the Amadeus booking system and conduct automated searches across reservation data.
Amadeus has separately acknowledged a vulnerability in a booking display environment. The company said the weakness made certain booking-display information accessible, although it has not publicly identified a specific product name, software version or component affected by the issue.
Information potentially exposed
At the time of the disclosure, SAS said it had identified four main categories of potentially exposed information:
- Booking references
- Date information associated with reservations
- Flight-related information
- The number of passengers included in a booking
SAS said no additional data categories had been identified for its passengers. Amadeus also said it had found no evidence that payment or other financial information was accessed, and no indication that ransomware was involved.
This is narrower than the information reported by some other airlines affected by the wider Amadeus incident. Depending on each airline’s integration and the data stored in Amadeus, some records elsewhere included email addresses, telephone numbers or travel document information.
SAS data breach timeline and key developments
The available timeline indicates that the SAS disclosure forms part of a wider, long-running security incident involving airline reservation information held by Amadeus.
- 10 August 2023: The earliest date in the reported exposure period. Airline notices indicate that unauthorised access to Amadeus reservation data could have occurred from this date.
- 23 September 2026: The reported end of the potential access period cited by affected airlines.
- October 2026: Amadeus published a statement confirming a vulnerability in a booking display environment. It said investigations were continuing and that it had found no evidence of financial data access or ransomware.
- 6 November 2026: Norwegian broadcaster NRK reported that Norwegian and travel agency Berg-Hansen had notified Norway’s data regulator. Norway’s National Security Authority warned that an unauthorised actor may have retained access for at least three years.
- 9 November 2026: The SAS data breach became public through reporting on the airline’s IMY filing. SAS identified 350,164 potentially affected travellers and confirmed its decision not to notify individuals at that stage.
- 10 November 2026: Further Swedish coverage repeated the SAS figures and information from the regulatory filing. No revised figure had been published by SAS.
How the Amadeus reservation access worked
The reported attack did not rely on a publicly released exploit or ransomware payload. Instead, an external actor allegedly used compromised system credentials to access the booking environment, then performed automated searches to retrieve reservation information.
Amadeus described the affected area as a booking display environment. Such an environment allows authorised users and connected organisations to look up reservation records, meaning stolen or exposed credentials could enable an intruder to make queries that resemble legitimate activity.
Separate technical reporting on one Amadeus exposure path found access credentials stored in clear text within an unprotected heap dump. That finding offers a possible explanation for how credentials could become available to an attacker, but it has not been confirmed as the credential compromise route used in the SAS data breach.
The activity represents confirmed real-world exploitation rather than a theoretical vulnerability. National security reporting and airline notices indicate that an unauthorised actor accessed Amadeus systems over an extended period. However, SAS and Amadeus have not publicly attributed the activity to a named individual or threat group.
No technical indicators of compromise, such as malicious IP addresses, file hashes, domains or system paths, have been published by SAS, Amadeus or national cyber agencies. This limits the ability of organisations to search directly for infrastructure associated with the actor.
Wider airline impact and current status
The SAS data breach is one part of a cross-airline incident. Japan Airlines, Cathay Pacific, Thai Airways and Finnair have issued notices concerning unauthorised access to reservation data held in Amadeus systems, supporting the conclusion that the exposure occurred at the provider level.
Cathay Pacific said credentials assigned to an Amadeus system account were used for unauthorised access. Finnair reported that approximately 116,000 reservations were involved, although around 750 were viewed. It issued new reservation numbers for a small number of bookings that remained active.
The scope is not identical for every airline because reservation platforms can contain different information for different integrations. SAS currently says only booking references, dates, flight details and passenger counts were identified in its affected records.
SAS continues to monitor the situation while Amadeus investigates. Its decision not to notify individual travellers could change if further data categories, evidence of misuse or a higher level of risk emerges.
Why the SAS data breach matters to organisations
Even without payment details, genuine booking references, travel dates and routes can make phishing messages more convincing. An attacker could impersonate an airline, travel agency or corporate travel service and refer to a real journey when requesting credentials, payments or personal information.
UK organisations may also be affected indirectly. Employees could have SAS journeys booked through an agency, or travel with another airline using Amadeus, without their employer having a direct relationship with the reservations provider.
Actions for employers and travellers
Organisations with staff travel programmes should take targeted precautions while the investigation continues:
- Warn employees who use SAS or Amadeus-backed travel services to treat unexpected booking messages cautiously.
- Verify itinerary changes, refund requests and payment demands through the airline’s official website or a known travel agency contact.
- Review active bookings and report unexplained changes to the relevant airline or travel management provider.
- Ask travel providers whether organisational bookings fall within the reported exposure period and whether reservation references have been replaced.
- Monitor for phishing that includes accurate routes, dates, passenger numbers or booking references.
Passengers should avoid following links in unsolicited travel messages solely because those messages contain convincing booking details. The presence of genuine information does not prove that a communication came from SAS, Amadeus or an authorised travel provider.
Originally reported by The Local Europe.
