Scandinavian Airlines says booking information belonging to 350,164 travellers may have been exposed through its reservations provider Amadeus, in the largest single-airline disclosure yet from a breach that has now touched carriers across Europe and Asia.

The disclosure was reported by Swedish public broadcaster SVT on 9 November 2026. It is part of a wider security incident at Amadeus, the travel technology company whose systems handle bookings for many of the world's airlines.

SAS says the affected information largely concerns older bookings and completed journeys. It includes booking references, dates, flight-related details and passenger numbers. The airline says it has not identified further categories of personal data in the affected SAS records so far.

How the breach happened

According to SVT, an external actor used compromised system credentials to gain access to Amadeus booking information and carried out automated searches. SAS has notified the relevant supervisory authorities, while Amadeus continues to investigate.

In its statement on the incident, Amadeus said a vulnerability affecting a booking display environment had made some reservation data accessible. It said it had fixed the vulnerability and enhanced its monitoring, with no evidence so far that payment or financial data was accessed.

SAS will not contact travellers individually

SAS reported the incident to Sweden's Authority for Privacy Protection, known as IMY. The airline told the regulator that it does not currently plan to contact all those affected individually, because it assesses the incident as not posing a high risk under the EU's General Data Protection Regulation. It could reconsider that decision if further information emerges.

Travellers who booked with SAS should still stay alert. A booking reference, combined with a surname, is often enough to open or change a booking on an airline website, and the same details can be used to make phishing messages look convincing.

Finnair and Norwegian are also affected

Finnair told SVT that about 116,000 of its reservations may have been affected. Amadeus is examining 750 of those reservations, while a small number of still-active bookings have been assigned new reference numbers to prevent unauthorised access. Finnair's figure counts reservations, not necessarily individual travellers, and cannot be added directly to the SAS total.

In Norway, airline Norwegian and travel agency Berg-Hansen have also reported the Amadeus incident to the data protection authority, according to E24. The Norwegian National Security Authority said on 6 November that an unauthorised actor may have had access to Amadeus systems for at least three years. The authority said the vulnerability was closed on 23 September 2026.

The Norwegian authority warned that information potentially accessible in the wider incident, depending on the booking, could include travel routes, contact details and passport numbers. That does not establish that those additional details were exposed in the SAS records. The investigation into the scale of the breach remains open.