Amadeus airline data breach
Unauthorised access to Amadeus passenger reservation systems exposed booking data from August 2023 to September 2026. Eight airlines have confirmed they were affected.
Key facts
- ProviderAmadeus, which runs reservation systems for many airlines.
- CauseAmadeus reported unauthorised access through a vulnerability in a travel booking display environment.
- ExposedBooking and contact data. Some airlines also report passport numbers or loyalty details. Figures differ by airline, see the table.
- Not affectedEvery airline says its own systems were not breached. Asiana says payment data sits on a separate system and was not affected.
- WindowAugust 2023 to September 2026, per Malaysia Airlines and Cathay Pacific.
Timeline
- 20 Oct 2026Korean Air says Amadeus notified it of possible leaked customer data. VisaVerge
- 28 Oct 2026Japan Airlines reports about 92,000 customers affected, about 2,000 with passport numbers. BleepingComputer · The Record
- 31 Oct 2026Malaysia Airlines warns customers that data processed through Amadeus may be exposed. Malay Mail · Lowyat
- 4 Nov 2026Singapore Airlines says about 46,000 booking records were accessed. The Star
Affected organisations
| Organisation | Country | Date | Sector | Type | Actor | What happened | Sources |
|---|---|---|---|---|---|---|---|
 ✅ ConfirmedSingapore AirlinesVia a vendor | Singapore | 4 Nov 2026 | Transport | Supply chain | None | Confirmed. About 46,000 booking records held by reservation provider Amadeus were accessed, about 620 with contact, travel document or KrisFlyer details. SIA's own systems were not breached. | The Star✓ 7 Nov |
 ✅ ConfirmedQantas (Amadeus)Via a vendor | Australia | 2 Nov 2026 | Transport | Supply chain | None | Confirmed. Qantas confirmed its booking data was among the Amadeus exposure, said its own systems remain secure, and notified Australian cyber authorities. | Beinsure✓ 7 Nov |
 ✅ ConfirmedMalaysia AirlinesSelangorVia a vendor | Malaysia | 31 Oct 2026 | Transport | Supply chain | None | Confirmed. Customer data processed through Amadeus from August 2023 to September 2026 may be exposed. The airline's own systems were not breached. | Malay Mail · Lowyat✓ 7 Nov |
 ✅ ConfirmedCathay Pacific (Amadeus)Via a vendor | Hong Kong | 30 Oct 2026 | Transport | Supply chain | None | Confirmed. Cathay said about 53,000 bookings were affected by unauthorized access to reservation data held by Amadeus between August 2023 and September 2026. | AeroCorner✓ 7 Nov |
 ✅ ConfirmedAll Nippon Airways (Amadeus)Via a vendor | Japan | 29 Oct 2026 | Transport | Supply chain | None | Confirmed. ANA said unauthorized access at its reservation contractor Amadeus may have exposed customer personal information. | VisaVerge · BleepingComputer✓ 7 Nov |
| ✅ ConfirmedAsiana Airlines (Amadeus)Via a vendor | South Korea | 29 Oct 2026 | Transport | Supply chain | None | Confirmed. Asiana said booking-related customer information was exposed through Amadeus and that payment data, held on a separate system, was not affected. | VisaVerge✓ 7 Nov |
 ✅ ConfirmedJapan Airlines (Amadeus)Via a vendor | Japan | 28 Oct 2026 | Transport | Supply chain | None | Confirmed. JAL said unauthorized access to the Amadeus passenger service system exposed reservation data of about 92,000 JAL and Japan Transocean Air customers, about 2,000 of them with passport numbers. | BleepingComputer · The Record✓ 7 Nov |
 ✅ ConfirmedKorean Air (Amadeus)Via a vendor | South Korea | 20 Oct 2026 | Transport | Supply chain | None | Confirmed. Korean Air said Amadeus notified it on 20 October that customer data including reservation numbers may have leaked, with no intrusion into its own systems. | VisaVerge✓ 7 Nov |
What to do
- Treat calls, SMS and emails about your booking as suspect. Airlines do not ask for card numbers or OTPs by message.
- Check bookings only through the airline's own app or by typing its address.
- Watch for phishing that quotes your real booking reference or flight.
FAQ
Which airlines were affected by the Amadeus breach?
Malaysia Airlines, Singapore Airlines, Japan Airlines, All Nippon Airways, Korean Air, Asiana Airlines, Cathay Pacific and Qantas have confirmed exposure, as of 8 November 2026.
Was Malaysia Airlines hacked?
Malaysia Airlines says its own systems were not breached. Customer data processed through Amadeus between August 2023 and September 2026 may be exposed, with no evidence that financial information was accessed.
What data was exposed?
Booking and contact details. Japan Airlines says about 2,000 records included passport numbers, and Singapore Airlines says about 620 included contact, travel document or KrisFlyer details.
Related stories
- Bank Rakyat website defacement Malaysia · 6 Nov 2026
- Rakuten Trade halts Bursa trading after a cyber attempt Malaysia · 30 Oct 2026
- Tabung Haji suspends all services after a cyberattack Malaysia · 8 Oct 2026
- Port of Tanjung Pelepas halted by a cyber incident Malaysia · 10 Sep 2026
Checked 7 Nov 2026. Methodology · Data CC BY 4.0