The Amadeus Breach: How One Supplier Exposed Passengers at Asia’s Biggest Airlines

Over the past two weeks, airline after airline across Asia has told customers that their booking data was exposed. Japan Airlines, All Nippon Airways, Cathay Pacific, Singapore Airlines, Korean Air, Asiana Airlines and Malaysia Airlines have all traced the problem to the same place: Amadeus, the Spanish travel technology company whose platforms handle reservations, ticketing and check-in for hundreds of airlines. None of the airlines’ own systems were breached. This is a supply chain incident, and it shows how one supplier can expose passengers of many companies at once.

Figures are as reported up to 4 November 2026. Amadeus has not disclosed how many airlines or passengers are affected in total, and investigations are ongoing.

What happened

Amadeus said it had become aware of a vulnerability affecting a travel booking display environment, through which certain booking data was accessible. Airlines including Cathay Pacific said the unauthorised party used login credentials assigned to an Amadeus system account. Amadeus said it fixed the vulnerability, added monitoring and detection, and found no evidence that payment or financial data was accessed.

The affected data was processed over a long period: between August 2023 and September 2026, according to the airlines. Amadeus began notifying airlines on 20 October 2026.

Which airlines are affected

Qantas has said it is investigating whether its bookings were involved. Because Amadeus serves many airlines worldwide, more disclosures are possible.

Three years of exposure, two weeks of disclosures

The gap between the long period of exposure and the short burst of disclosures is typical of supply chain incidents. Each airline must wait for its supplier’s findings, then work out which of its own customers are affected, so notices arrive one after another, often with incomplete numbers at first.

How it happened

1. A shared supplier. Many airlines run reservations, ticketing and check-in on Amadeus platforms, so passenger data from many carriers sits with one provider.
2. A system account. According to the airlines, the unauthorised party used login credentials assigned to an Amadeus system account. How those credentials were obtained has not been disclosed.
3. A booking display environment. Amadeus described a vulnerability in an environment used to display bookings, which made certain booking data accessible.
4. Data viewed. Names, booking references, itineraries and, for a small number of passengers, passport numbers and contact details.
5. The real risk: phishing. Payment data was not taken, but real booking references and flight details make fake airline emails and messages far more convincing.

Why it matters: third-party risk

The airlines did nothing wrong in their own networks, yet their customers were affected. That is the defining challenge of third-party risk: your data is only as safe as the weakest supplier that holds it.

Airlines in Japan have been here before. In 2021, a breach at the airline IT provider SITA affected about one million ANA and about 920,000 JAL frequent flyer members. For Singapore Airlines, the Amadeus incident is its third data breach since February 2021. Korean Air has said it will demand that Amadeus strengthen security, and that it will inspect every vendor that handles personal data on its behalf.

If you are a traveller: protect yourself

• Expect fake airline messages. Scammers may quote your real booking reference, name and flight to appear genuine.
• Never pay or log in through links in messages. Open the airline’s app or type its website address yourself.
• Guard your passport details. Airlines do not ask for passport scans, bank details or card numbers by email or text.
• Secure your mileage account with a unique password and two-step verification, and check your points balance.
• Check the airline’s official notice to see whether your bookings fall within the affected period.
• Report suspicious contact to the airline and, in Japan, forward phishing emails to the Council of Anti-Phishing Japan at info@antiphishing.jp.

If you are an organisation: remediate now

For airlines, travel companies and any organisation whose data sits with a supplier affected by an incident:

1. Get the facts from the supplier. Which systems, accounts, data types and time period were involved, and what has been fixed.
2. Identify affected customers. Match the supplier’s findings to your own records, starting with the most sensitive data such as passport numbers.
3. Notify and warn. Tell affected customers clearly what was exposed, and warn them about phishing that uses their real details. Meet your legal notification duties, such as reporting to Japan’s Personal Information Protection Commission.
4. Rotate shared credentials. Revoke and reissue any accounts, keys or tokens shared with the supplier.
5. Monitor for misuse. Watch for phishing campaigns that impersonate your brand, and for unusual activity on loyalty accounts.

Prevent: managing supplier risk

The takeaway

Your security is only as strong as the suppliers that hold your data.

The Amadeus breach did not touch the airlines’ own networks, yet hundreds of thousands of passengers across Asia were affected. For travellers, the immediate risk is convincing phishing that uses real booking details. For organisations, the lesson is to know which suppliers hold your customers’ data, hold them to clear security requirements, and be ready to act quickly when one of them is breached.

Sources

• The Record: More Asian airlines announce data breaches after attack on Amadeus
• PhocusWire: Amadeus data breach affects multiple airline partners
• Business Traveller: Major airlines report Amadeus breach
• VnExpress: Amadeus data breach exposes 46,000 Singapore Airlines bookings
• BleepingComputer: Japan Airlines suffers third-party data breach
• ANA: Special notice on unauthorised access at Amadeus
• TechRadar: Singapore Airlines says 46,000 booking records hit
• Aerocorner: Cathay Pacific says Amadeus breach hit about 53,000 bookings

Slides

Download the slides as PDF