Malindo Air confirmed it was hit by a data breach, potentially compromising data from around 30 million passengers.
The hack came to light after personal data from Malindo Air and Thai Lion Air was apparently being hawked in online forums.
The leaked data includes passport details, addresses and phone numbers.
In a Facebook post, the airline it has notified the relevant authorities and advises customers with online frequent flyer accounts to change their passwords.
It said no credit card details were stored on its servers and not compromised.
"We found out about this breach last week. We and a third party vendor are checking as we speak. We will advise passengers accordingly as per the investigation outcome," Malindo Air CEO Chandran Rama Muthy told the South China Morning Post.
It is hiring a third-party cybersecurity firm to conduct a full forensic assessment.
