Finnair has announced that personal information was compromised after systems operated by Amadeus IT Group, from which it receives services, were subject to unauthorized access.
According to Amadeus, the incident involved passenger name records for multiple airlines, including approximately 116,000 Finnair bookings. Of these, around 750 bookings were actually viewed, including 30 related to package tours offered by Aurinkomatkat, a Finnair Group travel brand. Only a small number of the viewed bookings were valid, and Finnair assigned new booking reference numbers to the affected reservations to prevent unauthorized access.
Timo Arunda, Chief Information Security Officer at Finnair, said: “We have requested a detailed explanation of this incident from Amadeus. While a detailed investigation is ongoing, Amadeus has already confirmed that there was no access to credit card numbers or passwords. Finnair’s systems have not been compromised.”
Amadeus is the data controller for the service in which the breach occurred and has reported the incident to data protection authorities in EU member states in accordance with the EU General Data Protection Regulation (GDPR). As the data controller, Amadeus is also responsible for notifying the affected individuals.
Finnair will contact affected customers by email after receiving their contact information from Amadeus. It has also reported the incident to Finland’s National Cyber Security Centre.
