Findivoza

November 7, 2026

Findivoza

Technology

Amadeus breach exposed airline bookings for three years — what passengers need to know

Faizan Altaf

For more than three years, an unauthorised outsider read airline booking records held by Amadeus, the Spanish technology company behind reservations, ticketing and check-in for hundreds of airlines. The access ran from 10 August 2023 to 23 September 2026, according to Japan Airlines, and it came to light only in the last week of October 2026, when airline after airline began warning its own passengers.

Japan Airlines alone counts about 92,000 affected customers. Cathay Pacific counts about 53,000 affected bookings. All Nippon Airways, known as ANA, counts about 37,800 affected customers. Korean Air, Asiana Airlines, Star Flyer and Malaysia Airlines have also confirmed that their passengers were caught up in the incident, but none has published a total yet, and Amadeus itself has not said how many airlines or passengers were affected overall. No flights were disrupted, and the airlines say no credit card numbers or passwords were taken. What was taken instead — names, booking references, flight dates and routes, and for a smaller group, passport numbers and contact details — is exactly the material that makes a scam message hard to spot.

At a glance

What happened: Unauthorised access to passenger booking records inside Amadeus ran from 10 August 2023 to 23 September 2026, and was disclosed by several Asian airlines between 23 and 30 October 2026.
Why it matters: Booking details were exposed for at least 129,800 customers of Japan Airlines and ANA, plus about 53,000 Cathay Pacific bookings, and a smaller group also had passport numbers and contact details exposed, which makes targeted scams much more convincing.
What happens next: Affected airlines are contacting passengers individually, Amadeus says it has reset passwords and increased monitoring, and Hong Kong’s privacy commissioner has opened an investigation, while the full scale remains unknown.

What happened

Amadeus is not an airline. It is a supplier that airlines rely on, and its Passenger Service System is the shared machinery that stores reservations and handles ticketing and check-in. When a passenger books a flight on an airline’s website, the booking can end up sitting on Amadeus computers. Cathay Pacific describes Amadeus as a company serving hundreds of airlines worldwide, and BleepingComputer reports its technology is used by more than 400 airlines.

That shared role is why one incident at a single supplier has shown up in the notices of so many different airlines at once: their bookings were sitting in the same place. One failure at a supplier like this reaches passengers who never chose it and never dealt with it directly. Japan Airlines said Amadeus told it on 23 October 2026 that traces had been found of reservation data being accessed externally. The airline stressed that its own systems were not the point of entry, that no credit card numbers or passwords had been compromised, and that flight operations were unaffected. Cathay Pacific and Malaysia Airlines gave similar reassurances about their own systems, and Korean Air and Asiana said they had found no evidence that their internal databases were compromised, according to Travel Weekly Asia.

How the disclosure unfolded

The dates show how slowly the picture emerged, even after the access had ended. Amadeus said it learned of a flaw on 21 September 2026, according to the German technology site heise online, which reported the matter on 13 October. On 1 October, Amadeus published a statement saying it had discovered a vulnerability in its travel booking display environment that could expose travellers’ data. At that point, the company said ransomware actors had not exploited the flaw and that no payment data had been exposed, according to BleepingComputer.

Then the airline notices began. Amadeus told Korean Air and Asiana Airlines on 20 October, according to The Business Times. Japan Airlines was told on 23 October. Cathay Pacific was told on 28 October and received further details on 29 October. BleepingComputer reported Japan Airlines’ disclosure on 29 October, the same day ANA announced a customer data breach tied to Amadeus. On 30 October, Cathay Pacific and Malaysia Airlines both published their notices to customers.

Who was affected

The numbers published so far come from three airlines, and they do not all count the same thing, so they cannot simply be added together into one grand total.

Japan Airlines, together with its group carrier Japan Transocean Air, counts about 92,000 affected customers. For about 90,000 of them, the records accessed were the reservation code, known as a PNR, the passenger’s name, the flight date, the flight sector and the class of service. For about 2,000 more, passport numbers, email addresses and phone numbers were also exposed.

ANA reported about 37,800 affected customers. Transclew, which read the airline notices, reported that about 1,700 ANA customers also had their email, phone number and passport number exposed. Cathay Pacific counts the incident differently: about 53,000 bookings, not customers. In most of those bookings, the information accessed was the booking reference, the passenger name and the flight details. In a smaller subset, contact details, travel document details or frequent flyer numbers were potentially accessed.

Korean Air and Asiana Airlines have both confirmed that their passengers’ booking information was affected, but neither has published an overall count. Star Flyer, a smaller Japanese carrier, has also posted a notice, and Malaysia Airlines has said some of its customers’ information may have been affected, without giving a number. Amadeus has not published totals, and did not answer BleepingComputer’s questions about how many airlines and customers were affected.

In short: at least 129,800 customers of Japan Airlines and ANA were affected, plus about 53,000 Cathay Pacific bookings, plus an unknown number of passengers of Korean Air, Asiana, Star Flyer and Malaysia Airlines.

What was taken, and what was not

For most affected passengers, the exposed information was limited to the booking itself: who was travelling, on which flight, on which date, in which class, under which booking reference. That may sound harmless, but a booking reference and a surname are the keys airlines themselves use to identify a reservation. LoyaltyLobby, a travel news site that read the airline notices, noted that a PNR and a passenger’s last name are pretty much the only things needed to modify a booking, such as changing the frequent flyer number or cancelling it altogether.

For a smaller group, the exposure went further. About 2,000 Japan Airlines customers and about 1,700 ANA customers had passport numbers, email addresses and phone numbers exposed as well. Cathay Pacific said a smaller subset of its affected bookings also included contact or travel document details.

What the airlines say was not taken is just as important. Japan Airlines said there had been no compromise of credit card numbers or passwords. Cathay Pacific said there was no evidence that financial or payment information was accessed, and Malaysia Airlines said there was currently no evidence that financial information had been accessed. No airline has reported evidence that the data has actually been misused, but that is not a guarantee, and the airlines’ phishing warnings show they are taking the risk seriously.

Two different explanations that do not yet fit together

The accounts of how the breach happened do not match. Cathay Pacific said the unauthorised access was carried out by an unauthorised party using login credentials assigned to an Amadeus system account. In other words, someone used a valid set of login details that belonged to Amadeus itself. Asiana Airlines gave a similar account.

Amadeus, on the other hand, has described a potential vulnerability that affected a display environment for travel bookings. That is a different kind of problem: a flaw in the software, rather than a stolen password. No notice has explained how the two accounts fit together. Was the vulnerability used to obtain the credentials, or were the credentials used separately? Whose account was it, and how was it obtained? Nobody has said. BleepingComputer concluded the vulnerability appears to have been maliciously exploited, but that is its reading, not an Amadeus statement.

Why a booking reference is worth stealing

It is easy to assume that a data breach only matters if money or passwords are stolen. This incident shows why that assumption is wrong. A fraudster who knows your name, your booking reference, your flight number and your travel date can write an email that looks exactly like a message from your airline. It can warn of a schedule change, ask you to confirm your details, or offer a refund that requires you to click a link and enter payment information. A passenger expecting a message about a real flight is far more likely to trust it.

Japan Airlines warned its customers to remain vigilant against phishing emails, fraudulent phone calls and suspicious websites impersonating the airline. Malaysia Airlines urged customers to stay alert for suspicious or unsolicited communications, particularly those requesting personal or financial information. The access went on for more than three years without being caught, which means whoever was reading these bookings had a long time to collect them. There is no public evidence that the data was sold or used, but the airlines would not be issuing phishing warnings if they thought the risk was zero.

A separate breach that is easy to confuse with this one

One more airline disclosure from the same week is not part of the Amadeus incident. Jin Air, a South Korean low-cost carrier, said it detected a breach on 28 October and disclosed it the next day. The attack exposed information belonging to 1,454 members, including names, birthdates, contact details and member IDs. But the breach was in Jin Air’s own membership system, not in Amadeus, and the airline reported it to South Korea’s Personal Information Protection Commission. Travel Weekly Asia described the Japan Airlines and Jin Air disclosures as separate data breaches, and the Jin Air figure of 1,454 should not be added to the Amadeus totals. ANA’s 21 October website suspension also appears linked to a different threat, PHP2Shell, not Amadeus, according to BleepingComputer.

What passengers should do now

The advice from the airlines is practical rather than panicked. Do not assume a message is genuine just because it quotes your real booking details. If an email or text about a flight asks you to click a link, enter payment details or share a password, go to the airline’s official website or app yourself instead of following the link. Check your bookings directly through official channels, and if anything has changed that you did not change, contact the airline at once. Be wary of phone calls claiming to be from an airline and asking for personal or financial information.

Cathay Pacific said it would notify affected customers individually, and Malaysia Airlines said it would provide further updates as more information became available.

Passengers who flew with the affected airlines between August 2023 and September 2026 and have not heard from their airline should not assume they were unaffected, because the airlines are still working through the data Amadeus provided. Check your email, including the spam folder, for a notice. For readers in Pakistan, the warning is practical: many journeys to East Asia connect through Kuala Lumpur, Hong Kong, Seoul or Tokyo on exactly these carriers.

Frequently asked questions

Was my flight booking affected by the Amadeus breach?

It may have been if you booked with Japan Airlines, Japan Transocean Air, ANA, Cathay Pacific, Korean Air, Asiana Airlines, Star Flyer or Malaysia Airlines between August 2023 and September 2026. Check your email, including spam, and check your booking on the airline’s official website or app. Some airlines are still working through the data, so no notice does not prove you were unaffected.

Was my credit card or password stolen?

According to the airlines, no. Japan Airlines said there had been no compromise of credit card numbers or passwords, Cathay Pacific said there was no evidence that financial or payment information was accessed, and Malaysia Airlines said there was currently no evidence that financial information had been accessed. The data accessed was mainly booking information, with passport numbers and contact details exposed for a smaller group of passengers.

How did the breach happen?

That is not yet clear, and the accounts do not fully agree. Cathay Pacific and Asiana Airlines said an unauthorised party used login credentials assigned to an Amadeus system account. Amadeus has described a potential vulnerability in a display environment for travel bookings, which it said it learned about on 21 September 2026. No notice has explained how the credentials and the vulnerability relate to each other.

Is my money or my booking safe now?

Flights are operating normally, and the airlines say their own systems were not compromised. Amadeus has reset passwords and increased monitoring, according to Cathay Pacific. However, the booking details that were exposed could still be used for phishing scams, so be cautious about unexpected messages that quote real flight and booking details.

What should I do if I get a suspicious message about my flight?

Do not click links or share payment details in reply. Go to the airline’s official website or app and check the booking there. Airlines have said they will contact affected customers individually.

Conclusion

The Amadeus breach is not a story about a single airline making a mistake. It is a story about how much of modern travel depends on a handful of shared systems, and how long a quiet intrusion into one of those systems can go unnoticed. For more than three years, someone was reading booking records belonging to passengers of at least seven airlines, and the passengers only learned about it when the airlines began publishing notices in the last week of October 2026. The damage reported so far is limited to booking details, plus passport numbers and contact details for a smaller group, and no payment data or passwords. But the main risk now is a convincing scam built from real travel details, so passengers who flew with the affected airlines between August 2023 and September 2026 should stay alert and check their bookings through official channels. Amadeus has still not said how many airlines or passengers were affected in total, or who was behind the access, and Hong Kong’s privacy commissioner has opened an investigation, Transclew reported.

This article is for general information and education only. It is not legal or financial advice.

Sources

Faizan Altaf

Faizan Altaf is the founder and author of findivoza.com, a news blog covering world, Pakistan, business, technology, health and sport in plain English. He writes for general readers who want clear, trustworthy news without jargon. His work focuses on explaining what happened, why it matters, and what to watch next.

Leave a Reply

Your email address will not be published. Required fields are marked *