Finnair Easy News

Finnair customer data included in global Amadeus data breach

Finnair has been informed by Amadeus of a data breach involving reservation data held by Amadeus.

According to the information Finnair has received from Amadeus, the breach involves flight lists of several airlines, including approximately 116 000 Finnair reservations. Of these, approximately 750 Finnair reservations have according to Amadeus been opened for examination.  Amadeus has informed Finnair that the unauthorised activity has been stopped. 

Only a fraction of the examined reservations are active, and Finnair has given new reservation numbers for those to prevent unauthorised access.  

“We have demanded detailed clarification of this incident from Amadeus,” says Timo Arndal, Finnair’s Chief Information Security Officer. “Detailed investigation is still ongoing, but Amadeus has already confirmed to us that credit card numbers or passwords have not been accessed. Finnair systems have not been compromised.” 

Amadeus is the data controller for the service affected by the data breach. According to the information received by Finnair, Amadeus has notified a data protection authority in an EU Member State of the personal data breach, as required by the EU General Data Protection Regulation (GDPR). As the data controller, Amadeus is also responsible for informing the individuals (data subjects) whose data was involved in the breach.  

Finnair will send information about the Amadeus data breach to customers whose contact information Finnair has received from Amadeus. Finnair has also contacted the National Cyber Security Center in Finland.

Finnair’s guidance for customers and agents:  

How do customer know whether their data was involved in the breach?  

Finnair will send an email to all customers whose data was accessed and whose contact details it has received from Amadeus. Customers can contact Amadeus directly at dataprotection@amadeus.com. As the data controller, Amadeus is responsible for informing those whose data was involved in the breach.   

Have the payment details been compromised?  

Amadeus has confirmed that no payment details have been compromised.   

Has customer’s Finnair Plus password been compromised?  

Amadeus has confirmed that no passwords have been compromised.   

What should customer do if their data was involved in the Amadeus data breach?  

Finnair will send an email to all customers whose data was accessed and whose contact details it has received from Amadeus.  

According to the information we have received from Amadeus, only a fraction of the reservations involved in the breach are still active.   

Finnair recommends that customers always remain alert to suspicious emails, text messages and phone calls. Do not open suspicious links.