Breach at booking supplier Amadeus exposes passenger records at Asian airlines
October 31, 2026 (Detected in September; airlines disclosed from October 30 to November 2, 2026)
Amadeus, a Spain-based travel technology company that runs the reservation systems of many airlines, detected unauthorized activity in September 2026. Malaysia Airlines, Japan Airlines, All Nippon Airways, Cathay Pacific, Korean Air and Asiana Airlines have since said some customer booking data may be affected. Reported figures are about 92,000 customers at Japan Airlines, about 37,800 passenger files at ANA and about 53,000 bookings at Cathay Pacific. Malaysia Airlines has not given a number. The records cover August 2023 to September 2026 and mostly hold names, booking references and flight details. For a smaller group they also include passport numbers, contact details or frequent-flyer profiles; Japan Airlines puts that at about 2,000 people and ANA at about 1,700 passport references. The airlines say their own systems were not compromised and report no sign that payment card data or passwords were taken. One report says the intruders used valid credentials rather than attacking each airline, and that Amadeus has revoked the affected access tokens and changed administrator passwords. No group has been named as responsible.
Why it matters
One supplier's breach reaches many airlines at once. Booking references and flight details let scammers write messages that look like they come from the airline, and the passport details exposed for some travelers are hard to replace.
What defenders can take from it
- Passengers: treat unexpected calls, texts and emails about a booking with suspicion, and check the booking in the airline's own app or website instead of using a link in a message.
- Never share passwords or payment details through an unverified channel. If your passport number was exposed, watch for attempts to use it to open accounts.
- Airlines and travel firms: review and rotate supplier access tokens and administrator passwords, and alert on unusual use of valid credentials in shared booking systems.