Global Airlines (Top 40) · Airline (Asia, legacy) · Data breach
Singapore Airlines
Headline
Singapore Airlines was caught in the 2021 SITA vendor breach alongside Finnair, SAS, Japan Airlines and Air India - frequent-flyer data for KrisFlyer members exposed through a processor the airline itself chose and the…
Not independently verified. Verification status: Unverified - heuristic first draft. Publish state: draft unverified.
Singapore Airlines was caught in the 2021 SITA vendor breach alongside Finnair, SAS, Japan Airlines and Air India - frequent-flyer data for KrisFlyer members exposed through a processor the airline itself chose and the passenger never saw named. Singapore has a comparatively strong data protection regime in the PDPA, which makes the row instructive: a well-regulated carrier in a well-regulated jurisdiction still exported its members' data into a shared vendor environment where a single intrusion reached multiple airlines at once (at least eight were named in initial reporting). Alliance loyalty programmes are the mechanism - the data has to move between carriers for the miles to work.
- Severity
- Evidence tierUnassigned
- Claims confirmed
- Last verified2026-08-04
Primary source. None recorded — Unverified - heuristic first draft.
Terms
Arbitration
Not independently confirmed this pass — GDPR applies for EU passengers; Singapore's own Personal Data Protection Act (PDPA) applies domestically.
Data sharing
CONFIRMED PARTICIPANT IN THE 2021 SITA MULTI-AIRLINE BREACH (see Finnair and British Airways rows for full details): Singapore Airlines (about 580,000 KrisFlyer and PPS members affected) was one of multiple airlines — at least eight named in initial March 2021 reporting, spanning Star Alliance and oneworld carriers — whose frequent-flyer members' data was exposed via SITA's passenger-data systems; no consolidated total of affected travelers was published. This illustrates how deeply INTERCONNECTED airline loyalty-program infrastructure is: a single vulnerable third-party vendor can simultaneously compromise data at directly COMPETING airlines that have no other business relationship with each other beyond shared alliance membership.
Fees and billing
Not itemized this pass.
Contacts
Privacy contact. Not recorded.
Legal notice. Not verified this pass. If publicly traded: SEC Form 10-K cover page gives the official corporate address; the Secretary of State business-entity search in the state of incorporation gives the registered agent, which must accept service. If private: the state registered agent is usually the only reliable route.
Mailing address. Not recorded.
Evidence
No claims have been itemized for this row yet.
No sources are on file for this row yet.
Source vault
Link status: Candidate - not yet fetched
| Document | Last fetch | |
|---|---|---|
| Privacy policy singaporeair.com/en_UK/us/legal/privacy-policy/ | Not fetched yet | NO (HTML only) |
| Terms of service singaporeair.com/en_UK/us/legal/conditions-of-carriage/ | Not fetched yet | NO (HTML only) |
| Website No URL recorded | Not fetched yet | — |
| Primary source No URL recorded Verification: Unverified - heuristic first draft | Not fetched yet | — |
Enforcement
No enforcement actions are linked to this row.
State statute
No HQ state on file, so no state statute applies by headquarters.