Threat watch / Breach
Amadeus: booking data of airline passengers accessed through a system account, at least six Asian airlines affected
Amadeus, the reservation provider of many airlines, told its customers that unauthorized parties could read booking-display data. Japan Airlines, Cathay Pacific, Korean Air, Asiana, Singapore Airlines, ANA and Malaysia Airlines have reported impacts, and Qantas has also commented. Amadeus describes a vulnerability. Cathay says the access used credentials assigned to a system account, between August 2023 and September 2026.
- Sector
- Transport
- Way in
- Software flaw
- Product or vendor
- Amadeus
- How it happened
- Amadeus says it "became aware of a vulnerability affecting a travel booking display environment" and that "certain booking-display data was accessible through the vulnerability". Cathay Pacific says Amadeus told it the access used "login credentials assigned to its system account", and that Amadeus responded with containment steps "including a password reset". The two descriptions are not reconciled in public. How the credentials were obtained is not public.[1][2][3] Checked 8 Nov 2026
- What was stolen
- Booking data. Cathay: in most cases booking reference, passenger name and flight details; in a smaller subset email, phone, travel document numbers and frequent flyer numbers. Japan Airlines: names, reservation codes and flights for all, plus passport numbers, frequent flyer numbers, email and phone for about 2,000 customers. Singapore Airlines: names, booking references, itineraries and booking classes, with contact and travel document details in about 620 records. Amadeus and the airlines say there is no evidence that payment or financial data was accessed.[2][3][4][7] Checked 8 Nov 2026
- Who was impacted
- Reported so far: about 92,000 customers at Japan Airlines and Japan Transocean Air, about 53,000 bookings at Cathay Pacific, about 46,000 booking records at Singapore Airlines and about 37,800 customers at ANA. Korean Air, Asiana and Malaysia Airlines confirmed impacts without public counts. Qantas has said it was affected or investigating, depending on the report. Affected airlines give a window of August 2023 to September 2026 and say their own systems were not compromised. The total across airlines is unknown.[2][3][4][5][6][7] Checked 8 Nov 2026
- Threat actor
- Not attributed
Timeline
- Amadeus notifies Cathay Pacific, and gives details the next day. Japan Airlines publishes a notice: 92,000 customers, Amadeus having told it the week before that its reservation data was accessed. [2][4]
- Cathay Pacific updates its statement: about 53,000 bookings, access between August 2023 and September 2026, credentials assigned to a system account, a password reset by Amadeus. [2]
- Reports add Qantas, ANA, Korean Air, Asiana and Malaysia Airlines. Qantas says Amadeus advised the issue was contained in September. [6]
- Singapore Airlines reports about 46,000 booking records affected. The Record counts six Asian airlines. No threat actor has claimed the breach and no sign of the data on the dark web was reported. [3][7]