Amadeus data breach: what Asian airlines disclosed

Last updated: November 5, 2026

Picture a travel-booking screen briefly displaying another passenger’s details. That limited visibility gap became the focus of an international cybersecurity incident affecting six Asian airline brands.

The exposure originated at Amadeus IT Group, which supplies reservation, ticketing and check-in technology. Although none of the affected carriers reported operational disruption, attackers obtained or accessed customer information through the provider’s booking-display environment. The incident shows how a weakness at a common technology supplier can place data from many unrelated organizations in one attacker’s reach.

Amadeus data breach: what we know

• Six Asian carriers disclosed customer data exposure connected to Amadeus.
• Japan Airlines said stolen information affected 92,000 customers.
• Singapore Airlines reported access involving 46,000 records.
• Cathay Pacific said 53,000 records were taken, containing booking and passenger information.
• Amadeus found no evidence of payment-data theft.
• Each affected airline said its own systems and services continued operating normally.

Amadeus confirmed that a vulnerability made some booking-display information accessible. The company said it had repaired the flaw, strengthened monitoring and detection, and begun working directly with customers and regulators.

Several questions remained unanswered. Amadeus did not disclose whether the threat actors had approached the company or reveal the complete number of affected organizations. The investigation was also still underway, so its assessment of payment data and ransomware did not constitute a final conclusion.

The information involved differed between carriers. Cathay Pacific listed passenger names, booking references, flight details, email addresses and frequent-flyyer numbers. Certain affected records also contained passports or other travel papers. In Singapore, exposed records included confirmation numbers, itineraries and travelers’ names.

A further detail could matter for incident response: the attackers reportedly used login credentials tied to an Amadeus system account. Available information does not show how those credentials were acquired, whether they were reused elsewhere or whether access extended beyond the booking-display environment.

Why this matters

The six disclosures appear to share a common route into customer data rather than six unrelated compromises at each airline. That distinction matters because it concentrates risk at a supplier used across multiple brands and markets. A single supplier-side weakness can expose records drawn from otherwise separate customer populations.

Such records may still be useful to criminals without card numbers. A traveler’s name, itinerary, reservation reference, email address or identity document can help make an impersonation attempt appear legitimate. Attackers may use that material in targeted scams, convincing phishing messages or fraudulent requests involving travel plans.

That risk can outlast the technical fix. Singapore Airlines said it would alert travelers with imminent departures so they could replace exposed reservation references, while also warning about fraudulent emails. The absence of flight disruption did not eliminate the possibility of secondary fraud.

Supplier oversight is another concern. An airline may maintain its own operational environment while depending on an outside provider to process or display reservation data. Security teams therefore need to identify which third parties can reach sensitive information, what accounts grant that access and how quickly those permissions can be revoked.

The disclosed numbers also require careful treatment. One airline described affected customers, while the other two figures referred to records. Their counting methods may differ, so treating the totals as a combined count of individuals would create false precision.

Decision checklist for affected security teams

Use the following checklist to turn the disclosures into specific investigation and containment steps:

• Verify the exposed fields:** Compare available booking-display data with the categories disclosed by the relevant carrier, including travel plans, contact details and identity documents.
• Establish the intrusion period:** Seek relevant access logs from Amadeus or the affected airline to determine when suspicious activity occurred and whether it continued after the fix.
• Audit supplier accounts:** Review activity involving system and vendor-connected accounts, looking for unusual logins, excessive permissions and credentials shared across environments.
• Restrict active access:** Where justified, revoke active sessions, replace exposed authentication material and verify that stronger login controls cover the compromised route.
• Hunt for secondary misuse:** Monitor for phishing, impersonation and fraudulent support requests involving known passenger or itinerary details.
• Review warning messages:** Confirm that customer outreach comes through a verified channel and avoids placing unnecessary personal information in the message.
• Map connected services:** Identify other Amadeus-linked tools that might expose comparable data and determine whether one account could reach more than the booking display.
• Retain useful evidence:** Preserve relevant logs, suspicious emails and incident records for analysis of both the original intrusion and any later criminal activity.

What to watch next

Further carrier statements, regulatory updates and additional details from Amadeus may establish the incident’s full scope. Investigators may also determine whether the system-account credentials provided access to any additional systems or services.

For defenders, the most important unanswered issue is whether the exposed booking environment was the sole pathway into customer information. Until that is resolved, targeted notifications, credential scrutiny, supplier-focused monitoring and vigilance for travel-themed scams remain the most useful next steps.

Key takeaways

• The customer exposure crossed a shared technology-supplier boundary rather than disrupting airline operations.
• Travel and identity information can enable phishing and impersonation even when no payment data is taken.
• Stolen credentials and supplier access warrant urgent review across affected organizations.
• Figures describing customers, accessed records and stolen records should not be added together as a count of unique individuals.