Malaysia Airlines, Cathay, JAL and Qantas caught in Amadeus breach: an outsider could see bookings for three years

Was your flight booking exposed in the Amadeus breach? If you flew with Malaysia Airlines, Cathay Pacific, Japan Airlines, ANA, Korean Air, Asiana or Qantas in the past three years, it is possible. Malaysia Airlines said on Sunday 1 November that some customer information may have been affected by a cybersecurity incident at Amadeus, its reservation technology provider, covering data processed between August 2023 and September 2026, according to Reuters reporting published by CNA.

Every airline involved says its own systems are safe. That is precisely the point. The weak link was a supplier that sits behind hundreds of airlines, and an unauthorised party was able to see booking data there for roughly three years before the hole was closed. For travellers, the immediate risk is not stolen card numbers but convincing phishing messages built on real flight details.

Which airlines are affected

Malaysia Airlines joins a growing list. Cathay Pacific, Japan Airlines, Japan Transocean Air, All Nippon Airways, Korean Air, Asiana Airlines and Qantas have all said their customers' data was exposed through Amadeus. Malaysia's flag carrier said it is working with Amadeus and relevant parties to investigate and assess the impact, and that there was no evidence financial information had been accessed.

Cathay Pacific said on 30 October that about 53,000 bookings were affected, according to Reuters via AsiaOne. In most cases the data included the booking reference, passenger name and flight details, but additional personal information was compromised in a smaller subset. Japan Airlines and Japan Transocean Air reported about 92,000 affected customers.

Qantas said Amadeus told it there had been unauthorised access to one of its systems, and that the issue was contained in September. "There is no impact to Qantas systems or databases, which remain secure," the airline said, according to the NZ Herald. Qantas alerted Australia's national cyber security offices. Air New Zealand said it did not believe it was affected.

What data was exposed

For most affected passengers, the exposed information appears to be booking records rather than financial data. For about 90,000 of Japan Airlines' affected customers, the information included reservation codes, names, flight dates, sectors and travel classes, according to Airways Magazine. For around 2,000, more sensitive details were accessed, including contact details, passport numbers and frequent flyer numbers.

Malaysia Airlines has not specified which data fields were affected or how many customers were involved, and has promised further updates. The figures reported by different airlines also measure different things, bookings in Cathay's case and customers in Japan Airlines' case, so they cannot simply be added to produce an industry total.

Amadeus said investigations were ongoing and there were no indications the vulnerability had been exploited for ransomware. Cathay said Amadeus had not identified evidence that the affected data had been misused, and that it had reset passwords and added enhanced monitoring and detection capabilities to its systems.

Your airline was not hacked. Its supplier was. That distinction matters to lawyers, but to a passenger whose passport number leaked, it changes nothing.

The difference between a booking record and a passport number matters. A booking reference and name can be used to look up or change a trip on some airline websites, while a passport number combined with a name and date of travel is valuable for identity fraud. Airlines that confirmed more sensitive data was involved for a subset of customers are expected to contact those passengers directly.

How the breach happened

Amadeus said it had become aware of a vulnerability affecting a "travel booking display environment" but did not say how many airlines or customers were affected. The company provides booking and other technology services to more than 400 airlines, as well as hotels and car rental firms, which makes it one of the most important, and least visible, pieces of infrastructure in global travel.

The long exposure window is what makes this incident unusual. Data processed from August 2023 until the vulnerability was closed in September 2026 may have been visible, although Airways Magazine noted that the processing period does not by itself establish how long an intruder actually had access. Nor does the description of a display environment mean Amadeus's entire reservation system was compromised.

Logon Software Asia Group said none of the affected airlines reported a breach of their own internal databases, and that the incident raised questions about supply chain security. "Do we know who holds our data, how they authenticate, and whether their access is still justified?" the company wrote. Earlier this year, we reported on a run of data breaches in Japan, in our report on ransomware and breaches at JR East and IDC Frontier.

What travellers should do now

The most likely misuse of booking data is fraud that looks real. A message that quotes your actual flight, booking code and name is far more convincing than a generic scam. Malaysia Airlines urged customers to remain vigilant against suspicious or unsolicited communications, especially those requesting personal or financial information, and Japan Airlines warned of phishing emails, fraudulent calls and websites impersonating its group. Sensible steps include:

• Treat any unexpected message about a refund, rebooking or compensation with suspicion
• Never share passwords, card numbers or one time codes by email, phone or chat
• Log in to the airline's app or website directly rather than following links
• Change frequent flyer account passwords and enable two factor sign in
• Watch for misuse of passport details if your airline says they were exposed

Travellers who believe they are affected should check notices on their airline's official website. Airlines typically contact affected customers directly, so unsolicited messages asking you to "verify" details should be treated as likely scams.

Frequent flyers should also check their loyalty accounts for unexpected activity. Miles and points can be redeemed for flights and vouchers, which makes loyalty accounts an attractive target, and a leaked frequent flyer number makes those accounts easier to find. Airline loyalty programmes usually allow members to review recent transactions and reset their login details online.

What it means for airlines and regulators

For airlines, the breach is a reminder that outsourcing technology does not outsource responsibility. Customers trusted Malaysia Airlines or Cathay Pacific with their data, not a supplier most have never heard of. Carriers will face questions from regulators about how they monitor vendors and how quickly they were told; some disclosed exposure days before others.

For regulators across Asia, from Malaysia's personal data protection authorities to Hong Kong's privacy commissioner and Australia's cyber agencies, the case tests rules written mainly for breaches inside a company's own systems. Expect tougher requirements for vendor audits and faster breach notification, an agenda that regional authorities have been building, as covered in our report on the cybersecurity pact between Singapore's MAS and the Bank of Thailand.

The Amadeus breach shows how one supplier can expose passengers across a dozen airlines without any of them being hacked directly. Malaysia Airlines is the latest to warn customers, and more may follow. For travellers, the practical risk is targeted phishing; for airlines and regulators, it is a hard lesson in supply chain security.