Thailand’s Transport Ministry orders aviation cybersecurity boost

Thailand’s Transport Ministry has ordered aviation agencies and service providers holding personal data to strengthen cybersecurity. The Civil Aviation Authority of Thailand has separately instructed Thai Airways to contact affected passengers promptly, advise them to change their login passwords and amend relevant booking details, such as ticket numbers.

The orders follow Thai Airways' November 9 disclosure that, in a preliminary assessment, approximately 60,529 passenger booking records may have been accessed without authorization through Amadeus IT Group, its reservation and passenger-service technology provider.

Deputy Transport Minister Siripong Angkasakulkiat instructed aviation agencies and service businesses maintaining public databases to secure access credentials, change passwords regularly, avoid easily guessed passwords and use technology to detect wrongdoing, The Nation said on 11 November.

What the records contained

Thai Airways said the records contained names, booking references, travel dates, flight routes and cabin classes. Approximately 376 records may also have contained additional details, including email addresses, phone numbers, passport numbers and nationalities. Amadeus stored the affected booking data between 10 August 2023, and 23 September 2026.

The airline said its own systems and flight operations were unaffected, as were passengers' credit card and financial information. As of its November 9 notice, it had found no evidence that the information had been made public.

Investigation and notification

Thai Airways said Amadeus revoked the credentials used for unauthorized access, reset affected passwords and strengthened monitoring and detection. The airline is continuing its investigation and examining information supplied by Amadeus; it plans to notify affected passengers individually once it has verified the relevant details.

Siripong said the National Cyber Security Agency was monitoring threats and working to prevent malicious access. The government is preparing a coordinated response involving the agency and the National Security Council, with investigations and legal action planned against those responsible for unlawful access to personal information.