Finnair passengers´ data included in Amadeus data breach

Amadeus provides reservation and ticketing software to airlines, hotels and travel agencies around the world. According to the information Finnair has received from Amadeus, the breach involves flight lists of several airlines, including about 116 000 Finnair reservations. Of these, about 750 Finnair reservations have been opened for examination, and of these, 30 are related to Aurinkomatkat travel packages.

Amadeus has informed Finnair that the unauthorised activity has been stopped. Only a fraction of the examined reservations are active, and Finnair has given new reservation numbers for those to prevent unauthorised access. “We have demanded detailed clarification of this incident from Amadeus,” said Timo Arndal, Finnairs Chief Information Security Officer.

“Detailed investigation is still ongoing, but Amadeus has already confirmed to us that credit card numbers or passwords have not been accessed. Finnair systems have not been compromised,” he added. Amadeus is the data controller for the service affected by the data breach.

Amadeus has notified a data protection authority in an EU Member State of the personal data breach, as required by the EU General Data Protection Regulation (GDPR). As the data controller, Amadeus is also responsible for informing the individuals (data subjects) whose data was involved in the breach. Finnair will send information about the Amadeus data breach to customers whose contact information Finnair has received from Amadeus.

Finnair has also contacted the National Cyber Security Center in Finland.