Thai Airways faces another bruising week: over 60,000 booking records accessed by hackers and a Munich–Bangkok lavatory pictured without running water. The carrier is still reeling from 5,600 stranded bags, cargo delays and the ousting of its chief executive.
Thai Airways has suffered a major data breach exposing more than 60,000 passenger booking records, potentially including sensitive passport information. Meanwhile, a photograph has emerged showing bottled water replacing a running tap in a lavatory on a Munich–Bangkok flight. The twin setbacks come as Thailand’s national flag carrier struggles with a succession of failures since disastrous flooding in late September. That crisis stranded thousands of bags and preceded the removal of Chief Executive Officer Chai Eamsiri. Since then, cargo backlogs and a cracked cockpit window have added to the airline’s troubles. Thailand’s aviation regulator has intervened over the cyberattack, while the Munich lavatory failure remains unexplained at this time.
Thai Airways International faces two fresh blows after hackers accessed more than 60,000 passenger records through an external reservation system. Separately, a Munich–Bangkok flight reportedly operated without running water in an aircraft lavatory.
Both incidents surfaced on Monday, November 9, following months of operational disruption at Thailand’s national flag carrier. The latest problems follow stranded baggage, cargo backlogs, an aircraft technical defect and the removal of its chief executive.
The cybersecurity breach is the more extensive incident, affecting approximately 60,529 passenger reservation records. Another 376 records may have contained sensitive information, including passport numbers, telephone numbers, and email addresses.
Airline confirms Amadeus data breach as Munich–Bangkok passengers report lavatory water failure
Thai Airways confirmed the intrusion on November 9, identifying international technology supplier Amadeus IT Group S.A. as the affected provider. Subsequently, Thailand’s aviation regulator intervened, ordering the airline to protect passengers and ensure individual notifications.
The compromised information concerned bookings made between August 10, 2023, and September 23, 2026. However, Thai Airways has not established that hackers maintained continuous access throughout those three years.
The airline has also not confirmed a discovery date in its public statement. Neither the attackers’ identities nor their method of entry has been disclosed.
On another front, aviation website LoyaltyLobby published a photograph supplied by a passenger on a Munich–Bangkok service. The image showed a plastic drinking-water bottle beside an aircraft lavatory sink.
According to the complaint, passengers were expected to use the bottle because running water was unavailable. The report prompted criticism of onboard facilities during a journey normally lasting approximately ten hours.
Separate incidents deepen scrutiny as Thai Airways discloses compromised booking and records
The two incidents have no established connection. Nevertheless, they add to a succession of problems affecting Thai Airways since September. Those setbacks have involved airport ground handling, international cargo, aircraft maintenance and senior management. The latest reports bring passenger information security and onboard facilities into the same period of scrutiny.
Thai Airways International Public Company Limited issued its official cybersecurity statement on Monday, November 9. The announcement followed notification from Amadeus concerning unauthorised access to passenger reservation information.
Amadeus provides reservation and passenger service technology to airlines internationally. Its systems manage booking information used by carriers and their customers.
According to Thai Airways, approximately 60,529 affected records contained passenger names, booking references, travel dates, routes and cabin classes. These details relate directly to individual journeys booked through the supplier’s systems. The records therefore included information concerning passengers’ travel arrangements and movements.
In addition, another 376 records potentially contained more extensive personal details. These included email addresses, telephone numbers, passport numbers, nationalities and frequent flyer membership numbers. Flight numbers, ticket numbers and seat assignments were also among the potentially exposed information. However, the airline did not establish that every category appeared in every affected record.
Up to 60,905 booking records implicated as Thai Airways says credit cards and internal systems are safe
The additional records could bring the total to approximately 60,905 if they are separate. Notably, Thai Airways has not confirmed whether every record represents a different passenger. Reservation systems can contain multiple records associated with the same traveller. Consequently, the number of compromised records does not necessarily establish the number of individuals affected.
Thai Airways stressed that passenger credit card information had not been compromised. Furthermore, the carrier maintained that its own internal systems remained unaffected.
Flight operations and passenger services continued without disruption, according to the airline. The intrusion occurred within Amadeus technology rather than through a confirmed breach of Thai Airways’ network.
That distinction identifies where the unauthorised access occurred. Nevertheless, the affected records concerned customers using Thai Airways reservation services. Some information included personal identification details, while other records contained booking references and travel arrangements. The full extent of the exposure remained under investigation.
Amadeus revokes access credentials as investigators seek the source and duration of passenger data breach
In response, Amadeus revoked the user credentials associated with the unauthorised access. The company also reset passwords for affected accounts and strengthened security monitoring. These measures followed the discovery of the intrusion. However, the available statements did not establish precisely when the breach was detected.
Nor did they identify those responsible for accessing the information. The method used to enter the supplier’s systems also remained undisclosed. Although the affected bookings covered more than three years, that period does not establish the intrusion’s duration. The airline has not confirmed whether access occurred on one occasion or over a longer period.
Thai Airways reported the incident to the relevant authorities and began examining the circumstances with Amadeus. As part of that process, the carrier announced plans to notify affected passengers individually. Those notifications would follow verification of the compromised information. However, no timetable was provided for completing the exercise.
The airline also did not establish how many passengers had already received notifications. Accordingly, the precise number of individuals awaiting information remained uncertain. The distinction between passenger records and individual travellers also remained unresolved.
Thai Airways reports no public data leak, but questions remain over possible misuse of passenger details
In its November 9 statement, Thai Airways apologised for the concern and inconvenience caused. The carrier maintained that there was no evidence of the accessed information being publicly disclosed.
Even so, that assurance did not establish whether the information had been copied or otherwise misused. The investigation had not reached a publicly disclosed conclusion.
Passenger reservation records can contain information useful for targeted phishing and travel-related impersonation scams. Names, booking references and itineraries can help criminals construct convincing fraudulent communications.
Nevertheless, Thai Airways has not reported confirmed fraud directly linked to the incident. There has also been no confirmed public disclosure of the compromised records.
The distinction between credit card information and other personal data is significant. Thai Airways specifically confirmed that passengers’ credit card details remained secure. However, the smaller group of potentially affected records included passport numbers and other identification information. The airline has not established the precise extent of that additional exposure.
Thai aviation regulator orders passenger notifications and confirms no disruption to flight safety
Thailand’s Civil Aviation Authority, known as CAAT, intervened on Tuesday, November 10. The regulator confirmed receiving a preliminary report from Thai Airways concerning the breach. It also announced that it was monitoring the investigation.
CAAT instructed the airline to protect affected passengers and ensure they received individual notifications. At the same time, the authority confirmed that the incident had not compromised aviation safety. Flight operations and airline services remained unaffected, according to the regulator.
The intervention placed the breach under formal aviation regulatory monitoring. However, CAAT’s statement did not identify any enforcement action against Thai Airways or Amadeus. Nor did it announce penalties arising from the intrusion. The authorities continue to examine the circumstances surrounding the unauthorised access.
The breach involved an international technology provider serving the aviation industry. By contrast, the second November incident concerned passenger facilities aboard an individual Thai Airways service. That complaint emerged through a photograph published by international aviation website LoyaltyLobby.
Munich–Bangkok lavatory complaint draws criticism after passengers reportedly rely on bottled water
The website reported on November 9 that a reader had encountered a Munich–Bangkok flight without running water. The accompanying photograph showed a plastic drinking-water bottle standing on an aircraft lavatory counter. A handwritten note was attached to the bottle, although its contents were difficult to establish.
According to the complaint, the bottle provided an alternative supply for passengers washing their hands. The normal running water was reportedly unavailable in the lavatory. The arrangement attracted attention because the Munich–Bangkok route involves a long-haul journey lasting approximately ten hours.
The photograph prompted mixed reactions among aviation commentators and passengers. Some criticised the reported absence of running water aboard a full-service international airline. Others suggested that the problem might have developed unexpectedly during the flight. Several commentators defended the cabin crew for providing a temporary alternative.
One commenter suggested that the failure might have affected only a single lavatory sink. However, the published complaint did not establish whether other sinks remained operational. Neither did it confirm whether the toilets themselves continued functioning. The report therefore did not establish a complete failure of the aircraft’s water system.
Flight date and aircraft remain unknown despite tracking details for Thai Airways Munich service
That distinction limits what can be concluded from the photograph. A defective sink does not necessarily establish a failure affecting every lavatory. Equally, the image did not show whether passengers had access to other functioning washing facilities. The full extent of the inconvenience remains unconfirmed.
Crucially, the actual date of the flight was not disclosed. The published complaint also failed to identify the flight number or aircraft registration. Thai Airways operates flight TG925 between Munich and Bangkok, but the report did not establish which departure was involved.
Flight tracking records show that TG925 departed Munich at 13.52 local time on November 9. The aircraft subsequently arrived in Bangkok at 06.01 on November 10. According to the tracking information, that service used an Airbus A350-900. However, no evidence connects that particular flight with the lavatory complaint.
The aircraft involved in the reported water failure therefore remains unidentified. Likewise, the available information does not establish whether the defect existed before departure. The water supply could have stopped functioning during the journey, but that possibility remains unconfirmed.
Thai Airways has yet to explain Munich lavatory fault, maintenance checks or passenger compensation
The complaint also contained no verified maintenance account. There was no confirmation that engineers had examined the lavatory before the aircraft departed Munich. Nor was there an established explanation of what caused the water supply to fail.
The published material did not establish whether the problem affected one sink or a wider section of the system. Furthermore, it did not identify how long passengers were without running water. The photograph also failed to establish whether the bottle remained available throughout the journey.
No detailed technical explanation from Thai Airways was included in the available reporting. The airline had not publicly identified the aircraft involved. There was also no reported compensation for passengers affected by the problem.
The report did not establish whether passengers had formally complained to the airline. Similarly, it contained no confirmed account of maintenance action following the flight. The condition of the affected lavatory after arrival therefore remained unknown.
Uncertainty over lavatory water failure leaves hygiene arrangements and aircraft condition unresolved
Running water provides passengers with facilities for washing their hands after using aircraft toilets. Bottled water can serve as a temporary alternative when a sink fails. However, the photograph did not establish whether the quantity supplied was sufficient for the remaining journey.
The availability of other lavatories also remained uncertain. Consequently, the complaint did not establish how many passengers were affected or for how long. The reported failure could have been confined to one sink, but that has not been verified.
Some commentators questioned whether the aircraft should have undergone additional maintenance checks before departure. Others suggested that cabin crew were responding to an unexpected technical problem. Neither explanation has been confirmed by maintenance records or an airline statement.
A single defective tap does not automatically establish that an aircraft is unsafe to operate. The relevant circumstances depend on the extent of the defect and applicable operating requirements. Nevertheless, the available material was insufficient to establish those circumstances.
Thai Airways’ baggage crisis and chief executive’s removal preceded latest passenger service complaints
There was also no indication that CAAT had opened a separate investigation into the Munich complaint. The regulator’s November 10 intervention concerned the Amadeus cybersecurity breach. Its assurance about flight safety related to that incident, not the reported lavatory failure.
The two reports follow a turbulent period for Thai Airways. In September, severe flooding and ground-handling disruption affected operations at Bangkok’s Suvarnabhumi Airport. Approximately 5,600 bags were stranded, while the airline cancelled numerous flights.
The baggage disruption affected passengers travelling through Thailand’s principal international airport. Thousands of bags remained separated from their owners as ground-handling operations recovered. Meanwhile, Thai Airways faced criticism over its response to the crisis.
The problems were followed by a major management development on October 2. Chief executive Chai Eamsiri said the airline’s board had removed him from his position. His departure followed criticism of the carrier’s handling of the flooding and baggage disruption.
The management upheaval came amid continuing scrutiny of the airline’s operational performance. However, the baggage crisis was not the final setback affecting the carrier. Further problems subsequently emerged at Suvarnabhumi Airport.
Cargo delays and cracked cockpit window add to Thai Airways’ string of separate operational setbacks
In early November, Thai Airways apologised for delays at its inbound cargo warehouse. Some shipments had reportedly remained outstanding since October 10. The backlog affected cargo handling at the same airport previously hit by the baggage crisis.
The cargo delays were separate from September’s flooding and ground-handling disruption. Nevertheless, both incidents involved the movement of goods through Thailand’s busiest international airport. The earlier problem affected passenger baggage, while the later backlog concerned inbound shipments.
The airline faced another technical incident on November 4. A Thai Airways Boeing 787-9 returned to Shanghai shortly after departure when pilots detected a cracked cockpit window. The aircraft subsequently returned to the Chinese airport following the discovery.
That incident involved a different aircraft and route from the reported Munich lavatory problem. Furthermore, no evidence establishes any connection between the two technical complaints. Neither has been linked to the Amadeus cybersecurity breach.
The sequence nevertheless covers several distinct areas of airline operations. September brought serious baggage disruption, followed by a change in senior management. Early November then produced cargo delays and a cockpit window problem. The latest reports concern passenger data security and onboard washing facilities.
Data breach confirmed but Munich lavatory incident remains unverified as investigations continue
The cybersecurity incident is the most extensive November development in terms of potentially affected records. It involves information associated with more than 60,000 passenger reservations. Some records potentially contained passport details, telephone numbers and other personal information.
By comparison, the Munich complaint concerns one reported flight and at least one lavatory. However, the aircraft has not been identified, and the extent of the water failure remains unknown. No verified account establishes whether the defect existed before departure.
The distinction between the incidents is also reflected in their official status. Thai Airways has formally acknowledged the Amadeus breach and reported it to the relevant authorities. CAAT has confirmed regulatory monitoring and instructed the airline to protect affected passengers.
The Munich complaint, meanwhile, remains based on a passenger photograph and accompanying report. No detailed public technical explanation was included in the supplied material. The actual flight, aircraft registration and duration of the reported failure remain unconfirmed.
For the data breach, several important details are also outstanding. Thai Airways has not disclosed when Amadeus discovered the intrusion or how the attackers gained access. Neither has it identified those responsible or established whether compromised information has been misused.
Passport exposure and passenger numbers remain unresolved as regulator monitors Thai Airways response
The airline’s confirmation that credit card details remained secure addresses only one category of passenger information. Other potentially exposed details include passport numbers, email addresses and frequent flyer membership information. The precise extent of that exposure remains subject to verification.
Another unresolved issue concerns the number of affected individuals. The airline identified 60,529 reservation records and another 376 potentially containing additional information. However, it has not confirmed whether those records relate to distinct passengers.
In parallel, the regulator is monitoring the airline’s response and its planned passenger notifications. CAAT has confirmed that the breach did not affect flight safety or airline services. No enforcement action was identified in its November 10 statement.
Thai Airways now says baggage failure was five times worse than admitted. Board orders compensation
Thai Airways defeats flood crisis but finds itself in a brewing crisis of confidence over its management
The Munich complaint presents a different set of unanswered facts. These include the flight date, aircraft registration, cause of the defect and number of lavatories affected. There is also no confirmed account of maintenance action following the journey.
As of Tuesday, November 10, Thai Airways and Amadeus were continuing their examination of the passenger data breach. The carrier planned individual notifications once the affected information had been verified. Meanwhile, the Munich lavatory complaint remained without a detailed public technical explanation.
The latest incidents leave Thai Airways dealing with separate problems involving passenger information and onboard facilities. They follow the September baggage crisis, October management upheaval and further operational setbacks in November.
It comes as the airline ponders its future as it looks for a successor to ousted Chief Executive Officer Chai Eamsiri, with signs that the Thai government is seeking more control in the boardroom.
Join the Thai News forum, follow Thai Examiner on Facebook here
Follow Thai Examiner on Google here
Receive all our stories as they come out on Telegram here
Follow Thai Examiner here
Further reading:
Thai Airways now says baggage failure was five times worse than admitted. Board orders compensation
Thai Airways boss fired by the board chaired by Finance Ministry chief on Friday over baggage crisis
Government takes a stronger hand as Thai Airways crisis at Suvarnabhumi Airport worsened Wednesday
Bangkok airports open and flights running but there are delays and baggage issues at Suvarnabhumi
