Finnish airline Finnair has confirmed that approximately 116,000 flight reservations were affected by a cybersecurity incident involving Amadeus, a major technology provider serving the global travel industry. The breach originated outside Finnair’s own infrastructure and has also affected several international airlines.
In a statement published on November 9, 2026, Finnair said Amadeus had informed it that unauthorized parties accessed reservation information belonging to multiple airline customers. Of the approximately 116,000 Finnair bookings involved, around 750 were opened for examination, including 30 associated with Aurinkomatkat holiday packages.
The distinction between affected reservations and those examined is significant. Although a large number of bookings were included in the incident, Finnair has not established that the attackers individually examined every reservation or obtained all the information associated with them.
Amadeus provides software supporting airline reservations, ticketing, and passenger services. Its systems process booking information for numerous travel companies, making the incident relevant to passengers beyond a single airline.
Finnair’s Chief Information Security Officer, Timo Arndal, said the company had requested a detailed explanation from Amadeus. The investigation remains ongoing, but the provider has confirmed that payment card numbers and account passwords were not accessed.
Finnair also emphasized that its own systems were not compromised. According to Amadeus, the unauthorized activity has been stopped, and security measures have been implemented to address the vulnerability.
Only a small proportion of the reservations examined by the attackers remained active. Finnair assigned new booking reference numbers to those reservations to reduce the risk of unauthorized access.
The incident forms part of a broader data exposure affecting airlines that use Amadeus technology. Japan Airlines previously reported that approximately 92,000 customers were affected, while Singapore Airlines disclosed around 46,000 potentially exposed booking records.
Thai Airways has also reported that approximately 60,529 passenger records may have been accessed. Some affected airline records contained additional personal details, including contact information and passport numbers, although the categories of exposed information differ between carriers.
Amadeus has acknowledged a vulnerability involving a travel booking display environment. The company stated that certain reservation information became accessible and that its investigation found no evidence of payment or financial data exposure.
The provider also reported no indication that the vulnerability had been exploited for ransomware purposes. It has introduced additional monitoring and detection measures while continuing to communicate with customers and authorities.
Finnair said Amadeus had notified a data protection authority in a European Union member state under the General Data Protection Regulation. As the data controller for the affected service, Amadeus is responsible for notifying individuals whose information was involved.
Finnair will separately contact affected customers whose contact details it has received from Amadeus. The airline has also informed Finland’s National Cyber Security Centre.
Passengers concerned about their information can contact Amadeus at dataprotection@amadeus.com. Finnair has advised customers to remain alert to suspicious messages and telephone calls that could attempt to exploit information about the breach.