News · Breach Analysis · Breaking

Amadeus breach exposes airline passenger records across Asia

Unauthorised access to Amadeus reservation systems exposed passenger records at Japan Airlines, ANA, Cathay Pacific, Malaysia Airlines and other carriers. The access reportedly ran from August 2023 to September 2026.

Mark FermorCTO, CMO and Founder, Firevault

Published 2 November 2026 · 4 min read

What happened

One supplier credential reached the booking records of several airlines. Amadeus IT Group, the Spanish travel technology company behind reservation, ticketing and check-in systems for hundreds of airlines, has notified carriers that an unauthorised party accessed reservation data in its systems.

Cathay Pacific says Amadeus described access by an unauthorised party using login credentials assigned to its system account. Affected airlines report that the access took place between August 2023 and September 2026, a period of roughly three years.

Amadeus has said it became aware of a vulnerability affecting a travel booking display environment. According to Reuters reporting carried by CNA, the company said investigations were continuing, that there were no indications the vulnerability had been exploited for ransomware, and it did not say how many airlines or customers were affected.

Which airlines have reported impact

Airline statements give the clearest picture so far:

• Japan Airlines reports approximately 92,000 affected customers. For about 90,000, the data was the booking reference, name, flight date, sector and class. For about 2,000, it also included email address, phone number, passport number, nationality and frequent flyer number.
• ANA reports approximately 37,800 customers who booked between 10 August 2023 and 23 September 2026. About 1,700 of them may have had contact details, passport number and nationality accessed.
• Cathay Pacific reports around 53,000 affected bookings, mostly booking reference, passenger name and flight details, with a smaller subset involving contact details, travel documents or frequent flyer numbers.
• Malaysia Airlines says some customer information processed between August 2023 and September 2026 may have been affected.
• Korean Air and Asiana Airlines have also been reported among affected carriers.

These figures are each airline's reported figures. A total across all airlines has not been published, so the numbers should not be added together as a final count.

All of the airlines quoted say there is no evidence that payment card details or passwords were accessed. Cathay Pacific reports that Amadeus has reset the password, added monitoring and has not identified misuse of the data.

Why this matters

No airline needed to be breached for its passengers to be exposed. Several carriers state that their own systems were unaffected. The exposure sat with a shared supplier that holds reservation records for many organisations at once.

Booking references, passport numbers and travel itineraries are valuable for targeted fraud. Someone who knows a real flight, booking code and name can send a convincing message about a rebooking, refund or document check. That is why every affected airline is warning customers about phishing.

The length of the access period is also significant. Access that goes unnoticed for years points to a gap in monitoring account behaviour, not only in preventing entry.

The practical response

For organisations that depend on shared booking or customer platforms:

• Ask suppliers which accounts can query your records, how that access is monitored and how quickly unusual queries are reported.
• Require phishing-resistant authentication and regular credential rotation for supplier service accounts.
• Prepare customer warnings in advance, so that real notifications are not confused with fraudulent ones.
• Keep an independent record of what customer data each supplier holds, so the scope of a notification can be established quickly.

For travellers, treat unexpected messages that quote your booking details with caution, and contact the airline through its official website or app.

These are Firevault recommendations, not claims that Amadeus or the airlines lacked these controls.

Where physical disconnection helps, and where it does not

Offline Secure Storage® keeps selected retained copies physically disconnected by default, with hardware-enforced isolation while disconnected. Authorised access uses a separate, non-IP connection-control process, and the connection is physically broken again when the session ends.

A live reservation system cannot be disconnected; airlines need it online every minute. Physical disconnection would not have stopped this access to working booking data. What it can do is keep critical retained copies, such as archives and recovery sets, away from any live network path, so that a misused credential cannot reach them.

The useful question for any organisation is which data must remain online all the time, and which can be retained offline until deliberately required.

Explore OSS for Business.

Sources

Japan Airlines statement; ANA statement, 30 October 2026; Cathay Pacific statement, 30 October 2026; CNA: Malaysia Airlines says customers may be affected by Amadeus breach; BleepingComputer: Japan Airlines suffers third-party data breach. All accessed 2 November 2026. Figures are attributed to those statements and reports; Firevault has not independently verified the incident.

Analysis by Mark Fermor. Featured image is an AI-generated editorial illustration, not a photograph of any affected airline or airport.