Amadeus Airline Data Breach Exposes Booking Records

An Amadeus airline data breach exposed booking records held by a travel-technology supplier for several Asian carriers in October 2026. U.S. and Canadian passengers should watch for convincing messages that misuse flight details. Cathay Pacific said on October 30 that unauthorized access to Amadeus records affected about 53,000 bookings. Japan Airlines and Japan Transocean Air identified roughly 92,000 affected customers, while All Nippon Airways (ANA) reported about 37,800. Malaysia Airlines also disclosed a possible impact on October 31. Korean Air, Asiana Airlines and Star Flyer reported potential exposure. None has published a complete customer count.

In each case, the notices trace the incident to a technology supplier. They do not establish intrusions into each carrier’s own network. Meanwhile, Cathay Pacific and Japan Airlines say their flights continue to operate normally. Investigations continue. The carriers have not published a consistent industry-wide total.

Importantly, the figures count different things: Cathay reports bookings, while JAL and ANA report customers. They cannot establish a unique passenger total.

Cathay Pacific confirms 53,000 affected bookings

In its October 30 security notice, Cathay Pacific said Amadeus notified it on October 28. The next day, the supplier provided further details. According to Cathay, someone used login credentials associated with an Amadeus system account to gain unauthorized access to reservation information.

Most affected Cathay records included passenger names, booking references and flight details. In addition, a smaller group of reservations may have included exposed contact details, travel-document information or frequent-flyer numbers. Cathay reported no evidence that the intruder accessed payment information. It said Amadeus reset credentials, strengthened monitoring and had found no evidence that anyone had misused the affected data. The airline plans to notify customers individually after checking the relevant records.

Japan Airlines reports 92,000 customers and ANA 37,800

Japan Airlines and Japan Transocean Air said they learned of the incident from Amadeus on October 23. Their October 30 notice covers approximately 92,000 customers whose reservation records showed signs of external access. About 90,000 records included names, booking codes, dates, routes and travel class. Roughly 2,000 customers faced potential exposure of additional details, including passport numbers, contact information and frequent-flyer identifiers.

However, JAL said the incident did not compromise credit card numbers or passwords. It has also contacted affected customers and reported no evidence so far of misuse or disruption to flights. For passengers calling from the United States or Canada, JAL lists a dedicated overseas inquiry number, +81-3-4332-7280, available on weekdays from 10 a.m. to 5 p.m. Japan Standard Time, excluding Japanese public holidays. The airline provides those details in its official incident FAQ.

ANA’s October 30 notice identifies about 37,800 customers who booked between August 10, 2023, and September 23, 2026. The larger group, about 36,100 people, had names and itinerary information among the exposed fields. For about 1,700 customers, the potential exposure extended to passport numbers, contact details, nationality, frequent-flyer numbers and other reservation information. ANA said the incident did not involve payment-card numbers or account passwords. It plans to contact affected travelers.

These numbers cannot form a verified passenger total. Cathay counts bookings, whereas JAL and ANA count customers. Shared itineraries, multiple reservations and differing airline records prevent a reliable calculation of unique people affected.

Malaysia Airlines confirms possible customer data exposure

In an October 31 customer notice, Malaysia Airlines said the Amadeus incident may have affected reservation information processed between August 2023 and September 2026. The carrier reported no breach of its own IT systems and no evidence that financial information had been accessed. It is working with Amadeus to establish the impact and advised passengers to watch for suspicious messages requesting personal or financial details. The airline did not disclose a customer count or a list of affected data fields.

Korean Air, Asiana and Star Flyer also disclose exposure

Korean Air said Amadeus notified it on October 20. An unauthorized party may have used Amadeus account credentials to access booking references. However, Korean Air found no signs of intrusion into its own database. It said it had contacted customers identified so far. Its public notice gives no overall affected-customer count.

Asiana Airlines issued a similar notice on October 23. The carrier received Amadeus’s notice on October 20. Likewise, it found no evidence of intrusion into its internal database. The airline continues to examine the types of information exposed. Both South Korean carriers warned customers against suspicious links and messages.

Japan’s Star Flyer also reported possible exposure on October 29. In this case, the records involved Amadeus services that ANA supplied to the airline. Star Flyer said it was working with ANA to assess the scope. It will contact customers once it has reliable details. Star Flyer did not release a customer count.

Condor reports require a separate qualification

Specialist reporting describes another technical exposure involving an Amadeus booking-display environment. It includes passenger data linked to Condor and Lufthansa. No public finding links that exposure to the account incident reported by Cathay, JAL, ANA, Korean Air and Asiana.

Condor and Lufthansa belong in the wider reporting context. Current evidence does not place them among victims of the same unauthorized-account incident. Separately, South Korean reporting describes an attack on Jin Air’s membership system interface. That incident affected approximately 1,454 members. Because that report describes a different access method, the Jin Air intrusion remains separate from this Amadeus incident.

What travelers in the United States and Canada should do

Travelers from New York, Los Angeles, Vancouver or Toronto may receive notices even for flights taken months ago. In fact, the records cover travel dates from August 2023 through September 2026, not just upcoming flights.

Passengers should use their airline accounts or official contact channels to check notices. They should also avoid unexpected email links. Names, flight details and booking references could help criminals impersonate airlines in messages about changes, refunds or account verification. Travelers should ignore unexpected requests for passwords, payment-card details or urgent transfers. They can also check their frequent-flyer accounts for unauthorized changes.

Amadeus delivers itinerary messages on behalf of travel providers. It directs customers to their airline or ticket issuer for booking assistance. Cathay, JAL and ANA have not announced flight cancellations linked to the disclosure. Travelers should rely on their carrier’s flight-status tools for operational updates rather than assume a data incident has disrupted their itinerary.

This incident involves airlines in several alliances, including carriers profiled in AeroSillage’s background guides to Oneworld, Star Alliance and SkyTeam. Sharing an alliance does not prove that another member airline faced exposure.

Other airlines that use Amadeus technology

Amadeus also supplies passenger-service technology to many airlines beyond those named in the October 2026 notices. Its 2025 corporate financing prospectus says 205 airlines had contracted its Altéa or New Skies passenger-service systems as of December 31, 2024. Examples listed in that document include:

• North America: Southwest Airlines and Spirit Airlines.
• Europe: Air France-KLM, Lufthansa, British Airways, Ryanair and Wizz Air.
• Asia-Pacific: Qantas, Korean Air, AirAsia, IndiGo and Jetstar.

This is a dated, non-exhaustive list of airline customers, not a list of breach victims. The contracts also cover different Amadeus products. They do not identify which airlines, systems or passenger records faced exposure in October 2026. Over time, some customer relationships may have changed since December 2024. For that reason, this report counts only airlines with evidence of exposure.

What Amadeus has confirmed and what remains unknown

Cathay Pacific says Amadeus has revoked the affected access and increased monitoring. Korean Air and Asiana describe unauthorized use of system credentials; the full access path, the extent of exposure across Amadeus customers and the precise number of unique travelers affected remain under investigation.

In short, the airline notices do not support a claim that every Amadeus client suffered a breach. There is also no basis to attribute the unrelated Jin Air attack or all reports of exposed booking-display data to the same intruder. AeroSillage will update this report when individual carriers or Amadeus publish new, verifiable findings.