Data Breach at Amadeus Exposes Passport Details from Norwegian and Asian Airline Bookings Since 2023

Reporting based primarily on nrk.no.

Amadeus Data Breach Exposes Norwegian Travel Records

A major data breach at global travel IT provider Amadeus exposed personal details, including names, passport numbers and travel patterns from millions of bookings made since 2023, affecting Norwegian travelers and companies as well as passengers of several Asian airlines. [1] Berg-Hansen and Norwegian notified Norway's Data Protection Authority on 27 October after Amadeus discovered an intrusion on 21 September that had persisted since 2023; access was shut down three days later. [1] The breach potentially exposed identity, passport and travel-pattern data from bookings made through Berg-Hansen for more than 190 Norwegian public and private entities, with under 300 bookings from 75 Norwegian organizations confirmed accessed. [1] Amadeus has stated no payment or financial data was taken and there is no evidence of ransomware use; Singapore Airlines reported 46,000 journeys possibly affected and Japan Airlines reported 92,000 customers affected, including passport details for 2,000. [1]

Norwegian Agencies Warn of Identity Theft and Security Risks

Norway's Data Protection Authority received notifications from both Berg-Hansen and Norwegian on 27 October regarding the Amadeus intrusion. [1] Director Line Coll stated that the agency takes the matter seriously because the detailed information accessed could be used for fraud and carries a risk of identity theft for individuals. [1] Norway's National Security Authority has warned affected organizations to assess risks to employees, change login credentials on travel-agency portals, and evaluate security implications of future travel booked before 23 September 2026. [1] NSM director Arne Christian Haugstøyl confirmed that sensitive data has been leaked and that the authority is informing relevant companies and departments so they can take necessary steps to reduce risks. [1] The authority bases its guidance on the assumption that all companies using Amadeus will inform their customers and recommend appropriate measures. [1] Affected organizations are urged to consider the security risk posed by a threat actor holding information about their employees and to assess whether personal data and travel details could endanger individuals, the company or national security interests. [1]

Berg-Hansen and Norwegian Confirm Impact and Response

Berg-Hansen chief executive Per Arne Villadsen said the company was informed on 26 October that Amadeus had detected an intrusion on 21 September and had closed unauthorized access three days later. [1] Villadsen noted that someone had gained access to passenger lists containing names, birth dates, company names, email addresses and telephone numbers, and in some cases passport information. [1] He added that Berg-Hansen chose to inform its customers the previous week and also reported the incident to the Data Protection Authority and the National Security Authority. [1] The company further notified politically sensitive clients after receiving advice from those authorities. [1] Villadsen stated that unauthorized parties had viewed under 300 bookings involving 75 Norwegian organizations, both public and private, and that all affected entities are being informed. [1] Norwegian press officer Catharina Solli confirmed that the airline group was affected by the Amadeus security incident and is cooperating closely with Amadeus to assess consequences and ensure necessary measures are implemented. [1] Solli emphasized that the group takes customer personal data very seriously and has also submitted a deviation report to the Data Protection Authority. [1]

Asian Airlines Disclose Scale of Exposed Bookings

Singapore Airlines reported that booking details for 46,000 journeys may have been exposed. [1] Japan Airlines stated that 92,000 customers could be affected and that email addresses, telephone numbers and passport numbers were leaked for 2,000 of them. [1] These disclosures followed earlier reports from the Asian carriers about the leakage of personal information from tens of thousands of journeys. [1]

Amadeus Statement and Global Context

Amadeus stated on its website that it had detected a vulnerability in the system that displays travel bookings and that certain booking data became accessible. [1] The company confirmed that no payment or financial information was extracted and that there are no indications the vulnerability was exploited for ransomware. [1] Amadeus noted that the breach occurred in its systems rather than those of its customers. [1] The company declined to provide further details to NRK beyond its press release. [1]

Other Notable Crime Developments

Tanzania's opposition leader Tundu Lissu was sentenced to four years for incitement after being acquitted of treason. [2] A Ghana Navy operation seized 4.8 tonnes of marijuana worth over US$1 million en route to Nigeria. [3] Kenyan cult leader Paul Mackenzie received a 200-year sentence for 191 murders. [4]

What to watch next: Norwegian companies and authorities will continue to assess the full consequences of the Amadeus breach and implement recommended protective steps, while Tanzanian courts handle related opposition cases and Ghanaian security forces maintain maritime surveillance against drug trafficking.