A breach at Amadeus exposed airline booking data. Expect phishing that knows your trip

In brief

Developing. Last updated 2 November 2026, 08:08 Dubai time (UTC+4).

Several airlines have told customers that an unauthorised party accessed reservation data held by Amadeus, the Spanish company that runs passenger service systems for reservations, ticketing and check-in. The airlines' notices put the access between August 2023 and September 2026. They say no payment card numbers or passwords were taken and that Amadeus has found no evidence of misuse so far.

What each airline has said

• Japan Airlines. JAL and Japan Transocean Air say Amadeus told them on 23 October. About 92,000 customers are affected: about 90,000 with booking and flight details, and about 2,000 with email, phone, passport number, nationality and frequent flyer number as well. JAL says it has emailed affected customers.
• ANA. About 37,800 customers who booked between 10 August 2023 and 23 September 2026: about 36,100 with booking details only and about 1,700 with fuller personal data, including passport numbers. ANA says the compromised credentials have been revoked and it will contact customers directly.
• Cathay Pacific. Notified on 28 October, Cathay says around 53,000 bookings were affected. It says Amadeus reset passwords and added monitoring, and that it will notify affected customers individually once its analysis is complete.
• Malaysia Airlines. In its own notice of 30 October, the airline says customer information processed through Amadeus between August 2023 and September 2026 may have been affected. It says its own IT systems were not compromised, and gives no number.
• Qantas. According to 7NEWS, a Qantas spokesperson said Amadeus told the airline that the issue "was contained in September", and that Qantas is still assessing the impact on its bookings. 7NEWS reports that Qantas notified the Australian Cyber Security Centre.
• Condor. Bloomberg reported that the German carrier said its data was affected.

Amadeus has not published its own statement that ByteNib could find. CNA reports that Amadeus said it had become aware of a vulnerability affecting a travel booking display environment, and that it did not say how many customers were affected.

Why it matters

ByteNib's reading: the exposure ran for about three years through credentials on one supplier's system, and every airline is learning the scope from Amadeus rather than from its own systems. For IT leaders, this is a reminder to ask core platform suppliers how they detect misuse of their own credentials.

What affected travellers should do

This advice is ByteNib editorial analysis.

1. Treat messages that quote your booking with suspicion. A correct booking reference or route does not prove a message is genuine. Go to the airline's app or website directly.
2. Never pay or re-enter card details in response to an unexpected "rebooking" or "refund" message.
3. Protect your frequent flyer account. Change its password and turn on two-step sign-in if the airline offers it.
4. If your passport number was exposed, watch for identity misuse. Ask the airline's inquiry desk whether a replacement is advisable.

Sources and scope

Airline figures come only from each airline's own notice: Japan Airlines (30 October 2026), ANA (30 October 2026), Cathay Pacific (updated 30 October 2026, 16:11 HKT) and Malaysia Airlines (30 October 2026). ByteNib could not read a Qantas statement of its own; its comments are as reported by 7NEWS (2 November 2026). The Amadeus comment is as reported by CNA (1 November 2026). The Condor line is Bloomberg's report, read in its syndicated version on The Star (30 October 2026). Sources were checked on 1 November 2026. The Malaysia Airlines and Qantas lines were checked on 2 November 2026. Figures are the airlines' own and may change as investigations continue. The "Why it matters" section and the traveller advice are ByteNib editorial analysis.

Drafted with AI assistance and reviewed by the editor before publication.

Continue exploring: Cybersecurity analysis, the related implementation tutorial, and the structured learning path.