SAS (Scandinavian Airlines) data breach

What happened

SAS has reported a suspected data leak to Sweden's privacy regulator IMY after an outside party used compromised system credentials to get into the booking system of its IT provider Amadeus and ran automated searches, Swedish broadcaster SVT reported on November 9, 2026. According to SAS, 350,164 people are affected. The leak mainly concerns older bookings and completed trips and covers booking references, dates, flight-related information and the number of passengers; SAS says no further categories of personal data have been identified so far. SAS confirmed to SVT that certain booking information linked to SAS was affected and that it has made the necessary reports to regulators. In its report SAS said it had decided not to notify affected passengers because it judged the incident not to be high risk under GDPR, though that could change as the Amadeus investigation continues. Finnair says about 116,000 of its reservations may be affected by the same incident.

What should I do?

1. Treat emails, texts and calls that quote your SAS booking reference or flight details as suspect, especially offers of refunds, compensation or rebooking.
2. Manage bookings and EuroBonus matters only through the SAS app or flysas.com, not through links in unexpected messages.
3. Don't give card details, passwords or one-time codes to anyone who contacts you about a booking.
4. Check upcoming SAS bookings for changes you didn't make and contact SAS through its official website if you see any.

Check the other services you use →