Overview
Over the past week, Japan Airlines, Cathay Pacific, Korean Air, Asiana Airlines, Singapore Airlines and Malaysia Airlines have each reported data breaches traced to Amadeus IT Group, the Spanish company behind flight reservation, ticketing and check-in platforms, per The Record. The airlines say their own systems and operations were not affected.
What Amadeus Says
Amadeus said it recently became aware of a vulnerability affecting a travel booking display environment, and that "certain booking-display data was accessible through the vulnerability." It says it has fixed the flaw and improved monitoring and detection. It declined to say whether the attackers had contacted it or how many victims there were.
According to the airlines, Amadeus told them the attackers used login credentials assigned to its system account. Amadeus says there is no evidence payment or financial data was accessed.
Reported Impact
| Airline | Reported impact |
|---|---|
| Japan Airlines | About 92,000 customers had information stolen (warning issued October 28, 2026) |
| Cathay Pacific | About 53,000 records; booking numbers, passenger names, flight details, and in some cases passports and other travel documents, frequent flyer numbers and email addresses |
| Singapore Airlines | 46,000 records accessed; confirmation numbers, itineraries and names |
| Korean Air, Asiana, Malaysia Airlines | Breaches disclosed; figures not given in the source report |
Why It Matters
This is a third-party concentration risk: one vendor serving hundreds of airlines and airports exposes many brands at once. Booking data such as names, itineraries and travel documents is well suited to targeted phishing and identity fraud. Other 2026 airline incidents include Iberia and Air Côte d'Ivoire.
Recommendations
- Travelers: treat unsolicited emails or texts about bookings with suspicion, and verify through the airline's official app or site.
- Affected passengers: watch for identity misuse if passport details were exposed, and follow airline guidance.
- Organizations: inventory vendors that hold customer data, require MFA on service accounts, and monitor for anomalous use of vendor-assigned credentials.