Amadeus Booking Breach Widens Across Asia Pacific as Malaysia Airlines and Qantas Confirm Exposure

A reservation platform run by Spain's Amadeus IT Group has become the centre of one of the widest airline data incidents disclosed this year, after carriers across Asia Pacific began telling passengers that booking records held inside a shared third party environment had been accessed. The disclosures have arrived one airline at a time, moving from Hong Kong to Tokyo to Seoul and then to Kuala Lumpur and Sydney, with each statement adding another group of affected travellers and another partial account of what was taken.

The mechanism described by Cathay Pacific is unusual in that the airlines themselves were not breached. In a notice published on October 30, the Hong Kong carrier said an unauthorised party had used login credentials assigned to an Amadeus system account to reach travel reservation data inside Amadeus systems, including reservation records relating to Cathay Pacific. Cathay said Amadeus notified it on October 28 and supplied further details on October 29.

Amadeus is not a household name, but it sits underneath a large share of global air travel. The company supplies passenger service systems that integrate reservations, ticketing and check-in, and more than 130 customers use its Altea software, a figure that describes the entire customer base rather than the number of airlines confirmed to be affected. The group recorded sales of around 6.5 billion euros in 2025, according to heise online.

The roster of confirmed or identified carriers now includes Cathay Pacific, Japan Airlines and its subsidiary Japan Transocean Air, All Nippon Airways, Korean Air, Asiana Airlines, Condor, Malaysia Airlines and Qantas. The Japanese and Hong Kong carriers published counts; the Korean and German carriers have not. Malaysia Airlines confirmed possible exposure on November 1 and Qantas followed on November 2, extending the incident into a region wide notification exercise.

Key Facts

Reuters reported on October 30 that Cathay Pacific said the breach affected around 53,000 of its bookings, covering records created between August 2023 and September 2026. In most cases the data included booking reference, passenger name and flight details; in a smaller subset it also included email and phone contacts, travel document details or frequent flyer numbers. Cathay said there was no evidence that financial or payment information was accessed, and that its own systems and operations were unaffected.

Japan Airlines and Japan Transocean Air put the total at about 92,000 customers. Their notice, dated October 28, said Amadeus had informed them on October 23 that traces showed a portion of reservation data had been accessed externally. For roughly 90,000 customers the exposed fields were reservation code, name, flight date, flight sector and class of service. For about 2,000 customers the records also included email address, phone number, passport number, nationality, frequent flyer number, airline, flight number, ticket number and seat number. JAL said credit card numbers and passwords were not compromised and that flight operations were unaffected.

ANA said about 37,800 customers who booked between August 10, 2023 and September 23, 2026 were affected. Around 36,100 had name, booking reference, travel date, routing and cabin class exposed, while about 1,700 additionally had email, telephone, passport number, nationality, frequent flyer number, airline, flight number, e-ticket number and seat number involved. The airline, which published its notice on October 30, said the compromised authentication credentials had already been revoked and that no credit card numbers or account passwords were involved.

Reuters reported on November 1 that Malaysia Airlines said some customer information may have been affected, that its own information technology systems were not breached, and that there was no evidence financial information had been accessed. The carrier said it was working with Amadeus and relevant parties to assess the impact. Qantas confirmed its own exposure a day later, without publishing a figure.

Business Traveller reported on November 2 that the published totals cannot simply be added together, because Cathay counts bookings while the Japanese carriers count customers. Korean Air, Asiana Airlines and Condor have been identified as affected without disclosed totals, and Japanese carriers Star Flyer, AIRDO and Solaseed Air, which receive Amadeus passenger services through ANA, were still establishing scope. An aggregate of more than 180,000 passenger and booking records was reported by breachnews on October 30.

Analysis

This was not a breach of nine separate airline networks; it was a single set of credentials inside a common supplier, and the victims are the airlines whose records happened to sit behind that account. Cathay's account is explicit that its own systems were untouched, and Malaysia Airlines says the same. That distinction moves questions of liability and remedy from the carriers to the vendor that holds the reservation data.

heise online reported on October 13 that a Spring Boot heap dump had been reachable without authentication, containing access credentials, authentication tokens and administrator passwords that would have allowed read and write access to the global system, along with hundreds of office IDs from travel agencies and booking offices in Germany. Amadeus was alerted on September 21, said the issue affected a display environment for travel bookings, and stated that payment or financial data could not be accessed. The technical finding and the account credential incident have not been publicly linked by the company.

The bigger picture here is that the travel industry's dependence on a handful of reservation backbones turns a single operational slip into a multi continent notification problem, and the industry's practice of counting exposure in different units makes the true size of that problem unusually hard to state. One carrier reports bookings, another reports customers, and a third reports nothing at all. The window is similarly awkward: JAL and ANA trace access from August 10, 2023 to September 23, 2026, while Cathay and Malaysia Airlines describe the period as August 2023 to September 2026, a span of more than three years during which records were created and, in some cases, left in place after travel was completed.

The absence of evidence of misuse is genuine and repeated across every statement, but it is also the weakest form of assurance available. Passport numbers, nationalities, dates of birth and booking references are the ingredients of convincing phishing and identity fraud, which is why every carrier has warned about fake emails, calls and websites. A password reset and enhanced monitoring contain the access; they do not recall the data. The judgement here is that this incident will be remembered less for what was stolen than for how long a supplier level credential could reach into live reservation records before anyone outside the vendor knew.

Why It Matters

For passengers, the practical consequence is that a booking made years ago may still be a live data point. The exposed fields vary by airline and by record, but the pattern is consistent: basic itinerary data for almost everyone in scope, and identity documents for a small, identifiable minority. That minority is the group most exposed to targeted fraud, and it is also the group hardest to warn quickly, because the contact details needed for the warning are part of what was accessed.

For airlines, the episode underlines how much of their security posture is rented rather than owned. Passenger service systems are deeply integrated, expensive to replace and shared by design, and the notice timelines show how slowly information travelled: Amadeus alerted on September 21 according to heise online, JAL was told on October 23, Cathay on October 28, and customers heard from their carriers days after that. Regulatory pressure will likely focus on that gap rather than on the intrusion itself.

For Amadeus, the commercial exposure is reputational before it is financial. The company's software underpins reservations for more than 130 Altea customers, and its 2025 sales of around 6.5 billion euros rest on airlines trusting it with exactly the data that was reached. Cathay said Amadeus had contained the incident with a password reset and added enhanced monitoring and detection; the harder task is convincing regulators and carriers that a system account with that much reach can be governed properly.

Next Up

More carriers are likely to confirm exposure in the coming days, particularly those that buy passenger services indirectly. Star Flyer, AIRDO and Solaseed Air were still working out their scope as of November 2, and Korean Air, Asiana Airlines and Condor have yet to publish counts. Regulators in Hong Kong, Japan, Malaysia and Australia will want a consistent account of the notification timeline, and affected passengers should expect individual notices once each airline finishes matching Amadeus records against its own.

The unresolved questions are the ones nobody has answered: how many airlines and customers were actually affected, when Amadeus first detected the problem, and whether the credential access is connected to the heap dump that heise online examined in October. Until those are settled, the safe assumption for travellers in the region is that itinerary data from the past three years should be treated as known to a third party.