The Civil Aviation Authority of Thailand (CAAT) has urged Thai Airways to quickly notify passengers whose personal data was compromised in the data breach. CAAT is also monitoring risk prevention measures and cybersecurity upgrades, assuring that flight safety is not affected.
On 11 Nov 2026 GMT+7, Air Chief Marshal Manat Chuanaprayoon, Director of the Civil Aviation Authority of Thailand (CAAT), disclosed updates regarding reports of unauthorized access to passenger data of Thai Airways Public Company Limited. CAAT has received initial reports from Thai Airways and is closely monitoring the situation.
Investigations revealed the incident is linked to a cyberattack on Amadeus IT Group S.A. (Amadeus), the global provider of Passenger Service Systems (PSS) used by leading airlines worldwide. Amadeus has been gradually notifying affected partner airlines, including Thai Airways.
Preliminary impact assessment shows that data of 60,529 Thai Airways passengers were accessed. This data pertains to travel history from 2023 onward. CAAT has directed Thai Airways to implement appropriate measures to protect affected passengers and has been informed of the airline's plan to directly notify each individual whose data was compromised.
To ensure passengers are aware of the situation and can promptly take steps to protect or manage potential risks to their personal data, CAAT emphasizes that although the breach did not originate from Thai Airways' own systems, the incident currently poses no threat to flight operation safety or airline services. Thai Airways continues to operate flights and serve passengers as usual.
CAAT will continue to monitor developments of the incident and the airline's data protection and cybersecurity measures closely to ensure passengers receive appropriate care and to maintain confidence in the safety and service quality of Thailand's civil aviation system.