SAS reports suspected leak of 350,000 travellers’ booking details
Booking information connected to more than 350,000 SAS travellers may have been exposed through its reservation supplier, but the airline has decided against notifying affected passengers for now.
The incident concerns 350,164 people, according to SAS’s notification to Sweden’s privacy regulator IMY, obtained by SVT Nyheter. SAS says older bookings and completed journeys account for most of the affected information.
The airline identifies booking references, dates, flight information and passenger counts. It says no additional categories of personal information have so far been identified.
According to the notification, an outside actor used compromised system credentials to enter supplier Amadeus’s booking system and run automated searches. Amadeus is still investigating.
SAS says it has notified the relevant supervisory authorities. Its decision not to contact travellers rests on its assessment that the incident does not pose a high risk under data-protection rules. That decision could change if new information emerges.
DailySweden
DailySweden's desk of editors, reporters, researchers and investigative journalists. We bring readers factual, truthful and objective reporting on the issues that matter to them.