SAS reports suspected breach affecting 350,000 passengers

More than 350,000 SAS passengers may have had booking details exposed in a suspected data breach, SVT reports, citing a filing to Sweden’s privacy regulator, the IMY. SAS says the incident mainly concerns older bookings and completed trips.

The airline says 350,164 people are affected. The exposed information may include booking references, dates, flight-related details and the number of passengers. SAS says no other categories of personal data have so far been identified.

An external actor is believed to have used compromised system credentials to access the booking system of Amadeus, SAS’s IT provider, and then run automated searches. Amadeus is investigating the incident.

SAS has reported the incident to the IMY but has decided not to notify affected passengers, saying it does not consider the breach to pose a high risk under GDPR. The airline says that decision could change if new information emerges.

Norwegian broadcaster NRK reported on Friday that unauthorised users may have had access to information in Amadeus’s booking system for up to three years. The report said the data could involve Norwegian passengers and customers of travel agency Berg-Hansen, and that passport details may have been accessible in some cases.