Suspected data leak at SAS - over 350,000 booking details may have been revealed

According to SAS, the leak mainly concerns older bookings and completed trips. It is about "booking references, date information, flight-related information and information on the number of passengers".

According to SAS, 350,164 people are affected by the incident. SAS states that no additional categories of personal data have so far been identified in the leak.

Investigate the incident

An external actor is said to have used "compromised system data" to get into the IT provider Amadeus' booking system. After that, the actor must have performed automated searches.

SAS has reported the incident to IMY. The investigation at Amadeus is ongoing.

In the notification, the company writes that they will not inform the affected travelers. SAS assesses that the incident does not pose a high risk according to GDPR. But the decision can be changed if new information comes to light.

NRK reported on Friday that unauthorized persons may have had access to information in the Amadeus reservation system for up to three years. Among other things, for travelers with Norwegian and the travel agency Berg-Hansen, where passport information may also have been accessible in some cases.

SVT Nyheter is looking for SAS.