The Norwegian Data Protection Authority (Datatilsynet) has communicated about a personal data security breach related to Amadeus IT Group, following the receipt of several notifications from actors in the travel sector.

The authority received breach notifications, notably from Berg-Hansen Reisebureau AS and the Norwegian group, concerning Amadeus IT Group, a provider of technical solutions for booking airline tickets, hotel rooms, and rental cars. According to the National Security Authority (NSM), a malicious actor had access to the company's systems for at least three years, consulting various categories of personal data, before the breach was corrected. Datatilsynet is currently assessing the scope and severity of the incident.

The authority emphasizes that the compromised data can be exploited for fraud and other criminal acts. It recommends that potentially affected individuals take measures such as changing their passwords, enabling two-factor authentication, and verifying their account information. A warning is also issued against follow-up threats, such as phishing attempts using travel booking details to gain credibility. Norwegian authorities have centralized their advice and guides on digital security on the site sikkert.no.