The personal details of over 280 KrisFlyer members may have been seen by other customers due to a software bug affecting Singapore Airlines' (SIA) website last Friday.
"We have been made aware of a number of cases in which a customer (who) logged in to his or her KrisFlyer account, under certain specific conditions, may have been able to see selective details of another customer," an SIA spokesman said in response to queries.
These details may have included names, e-mail addresses, account numbers, membership tier statuses, KrisFlyer miles and rewards, travel history and, in seven cases, passport details.
The spokesman added that the breach occurred when any two members logged in to their KrisFlyer accounts and accessed transactions displaying their membership information at the same time, while also being assigned the same server by the system.
The software bug arose from a change to SIA's website homepage on Friday, and the incident occurred between 2am and 12.15pm.
Investigations based on system logs determined 285 cases in total.
On Saturday, Facebook user Tricia Leo said in a post that when she logged in to her KrisFlyer account, she realised that she could see another person's e-mail address on her profile page.
"I tried a new login and I could see his entire history, upcoming trips, miles," she wrote.
"If organisations that demand our personal data don't guard our information properly, then they need to be called out on it."
In a statement, SIA said that no changes were made to members' accounts and no credit card details were disclosed.
"We have established that this was a one-off software bug and was not the result of an external party's breach of our systems or members' accounts," the airline said. "The issue has been resolved and we will carry out a detailed review to ensure this will not happen again."
"The protection of our customers' personal data is of utmost importance to SIA, and we sincerely regret the incident," it added.
SIA is following up directly with affected customers, and has voluntarily informed the Personal Data Protection Commission (PDPC).
A PDPC spokesman confirmed that it had been notified of the incident, and said that the commission was looking into it.
The incident comes after a number of data leak cases here last year.
The Straits Times reported in August that more than 4,300 Shangri-La International Hotel Management rewards club members - including "a small number" of Singapore customers - had details like names and e-mail addresses leaked.
In July, ST reported that some 3,000 RedMart customers were affected by a data breach that leaked their e-mail addresses and put them at risk of phishing.
The same month, it was reported that Singapore suffered its worst cyber attack when hackers stole the personal particulars of over 1.5 million patients from SingHealth.
