Amadeus Data Breach: Airline Booking Records and Some Passport Numbers Exposed, What Is Confirmed and What to Do This Week

Amadeus, the travel technology company behind many airline reservation systems, says a flaw exposed booking data, and airlines across Asia have told customers that names, itineraries and, for some travelers, passport numbers were accessed. If your staff fly for work, or an outside platform holds your customer records, pay attention: the airlines say their own systems were not breached, yet their customers were still exposed.

What happened in the Amadeus data breach

Amadeus published a short statement in October 2026. It says the company became aware of a vulnerability affecting a travel booking display environment, and that certain booking-display data was accessible through it. Amadeus says it has fixed the flaw, added monitoring and detection, and is in direct dialogue with customers and authorities.

The airlines supplied most of the detail. Japan Airlines says Amadeus told it on October 23, 2026 that its systems had been accessed between August 10, 2023 and September 23, 2026, a span of more than three years. Cathay Pacific and Malaysia Airlines also give a window of August 2023 to September 2026. Qantas said Amadeus advised that the issue was contained in September.

Which airlines are affected by the Amadeus breach

These figures count different things, customers in some cases and bookings or records in others, so they should not be added together. Qantas says it is potentially impacted and is working with Amadeus to understand the effect on its bookings. No exposure of Qantas customer data has been confirmed in the reporting we read.

For most affected customers, the data was the basics of a booking: reservation code, name, flight date, route and class of travel.

What is confirmed, what is claimed and what is not known

Confirmed by the companies involved:

• Amadeus acknowledges a vulnerability and says booking-display data was accessible through it.
• Airlines have published customer or booking counts and the types of data involved.
• Airlines reporting on their own systems say those systems were not compromised.

Claimed, and not independently verified:

• Amadeus says there is no evidence that payment or financial data was accessed, while noting that its investigations continue.
• Amadeus says there are no indications the vulnerability was exploited for ransomware.
• Japan Airlines says credit card numbers and passwords were not compromised, and that there is no evidence so far of customer information being misused.

Not known:

• Who was responsible. Amadeus declined to tell The Record whether attackers had contacted it, or how many victims there are.
• How many airlines and travelers are affected in total.
• How the two explanations fit together. Amadeus describes a vulnerability, while airlines citing Amadeus describe unauthorized use of login credentials assigned to a system account. We found no public explanation from Amadeus connecting the two.

A note on sourcing: we opened the statements from Amadeus and Malaysia Airlines and ANA Group's first notice directly. Pages from Japan Airlines, Cathay Pacific and ANA's update would not load for us, so those details come from search copies of the notices and from reporting by BleepingComputer and The Record. We did not find a Singapore Airlines notice, so its figures come from press accounts of its disclosure.

Why the Amadeus breach matters for a business

There are two separate risks here.

The first is to your people. If employees book travel on these airlines, a criminal holding a real name, booking code and itinerary can write a very convincing message. Malaysia Airlines tells customers to stay alert for suspicious or unsolicited messages, especially those asking for personal or financial details, and The Record reports that Japan Airlines is urging vigilance against phishing emails and fraudulent phone calls. A fake rebooking fee sent to an executive assistant or travel coordinator is an obvious way to use this data.

The second is to your own vendor chain. The airlines did not need to make a mistake on their own networks for their customers to be exposed. If a platform stores your customer records, its weak spot is your weak spot, and your customers will expect to hear about it from you.

What to do this week

Amadeus data breach questions people are asking

Was my flight booking part of the Amadeus data breach?

Possibly, if you booked with one of the named airlines between August 2023 and September 2026. Use your airline's official website or customer service to check, and do not rely on links in an unexpected message.

Were passport numbers exposed in the Amadeus breach?

Yes, for a subset of customers. Japan Airlines puts this at about 2,000 customers and ANA at about 1,700 with passport or contact details. Cathay Pacific and Singapore Airlines also list travel documents for some bookings.

Were credit cards or passwords stolen in the Amadeus breach?

Amadeus says there is no evidence that payment or financial data was accessed, while its investigations continue. Japan Airlines says credit card numbers and passwords were not compromised.

How many airlines were affected by the Amadeus breach?

There is no public total from Amadeus. Seven Asian airlines have disclosed confirmed or possible exposure, and Qantas says it is potentially impacted.

Do I need a new booking reference?

Singapore Airlines is contacting affected customers with upcoming trips to arrange new booking reference numbers. If you fly another airline, follow what that airline tells you directly.

Who hacked Amadeus?

That has not been made public. We found no attribution from Amadeus or the airlines in the sources we read.

The bigger lesson

You can outsource a system, but you cannot outsource the relationship with the customer whose data it holds. These travelers heard the news from their airlines, and access is reported to have run for more than three years before it ended. Know which vendors hold your data, how their system accounts are protected, and how fast they have to tell you when something goes wrong.

Want your vendor access and account controls reviewed? See our security hardening services or request a quote.

Get security alerts by email, with the free checklist, at our security alerts page.

Sources: Amadeus statement; Malaysia Airlines notice; ANA Group notice; BleepingComputer on Japan Airlines; The Record on the airline disclosures; The Record on Japan Airlines; Cyber Daily on Qantas; TravelHost via Yahoo on Singapore Airlines and ANA.