Amadeus Breach Exposes Booking Data From Japan Airlines, Cathay Pacific, Singapore Airlines and Other Asian Carriers

By Kaeleb Savon Heck

SINGAPORE, Nov. 5, 2026 — A cyberattack on the Spanish travel-technology company Amadeus has now exposed booking records from at least six Asian airlines, with Japan Airlines reporting about 92,000 affected customers, Cathay Pacific about 53,000 bookings and Singapore Airlines about 46,000 records.

The airlines say their own systems were not breached. The data was taken from Amadeus, which runs the reservation, ticketing and check-in platforms that hundreds of airlines rely on. Each airline reported that no payment or financial information was involved, but the stolen records include names, booking references and flight details, and in smaller numbers of cases emails, phone numbers, passport details and frequent-flyer numbers.

The disclosures have arrived one at a time over two weeks, and Amadeus has not said how many customers in total are affected.

What the airlines have disclosed

The first public signs came from South Korea. Korean Air told affected customers that it received official notice from Amadeus at 10:44 p.m. on Oct. 20, according to MoneyToday, and that the exposed information included reservation numbers. The Korea Times reported that Asiana Airlines was also affected, and that Asiana said payment data was not involved because it uses a separate system for transactions.

Japan Airlines said on its website that it and Japan Transocean Air were told on Oct. 23 that traces showed some reservation data had been accessed from outside. The airline said the traces covered Aug. 10, 2023, to Sept. 23, 2026. Roughly 90,000 customers had a reservation code, name, flight date, flight sector and class of service exposed. About 2,000 more also had an email address, phone number, passport number, nationality, frequent-flyer number, ticket number or seat number exposed. That is about 92,000 people in total. JAL said no credit card numbers or passwords were compromised.

Cathay Pacific said Amadeus notified it on Oct. 28 and sent more details on Oct. 29. The airline said about 53,000 bookings were affected between August 2023 and September 2026. In most cases the exposed information was a booking reference, passenger name and flight details. In a smaller group it also included email and phone contacts, travel document details or a frequent-flyer number. Cathay said it has found no evidence that financial or payment information was accessed.

Malaysia Airlines said on Sunday, Nov. 1, that some customer information may have been affected, covering data processed between August 2023 and September 2026, according to Channel NewsAsia. It said its own IT systems were not breached and that it has no evidence financial information was accessed.

Singapore Airlines made its disclosure on Tuesday, Nov. 3. It said about 46,000 booking records were accessed, including customers' names, booking reference numbers, travel itineraries and booking classes. For about 620 of those records, email addresses, phone numbers, travel document details and KrisFlyer membership numbers may also have been accessed. Amadeus told the airline that no bank or credit card information was exposed and that no bookings were changed. As a precaution, Singapore Airlines is contacting affected customers who have upcoming trips so they can change their booking reference numbers.

What Amadeus has said

An Amadeus spokesperson told The Record from Recorded Future News that the company "recently became aware of a vulnerability affecting a travel booking display environment." The spokesperson said that "certain booking-display data was accessible through the vulnerability," that there is no evidence payment or financial data was accessed, and that there are no indications the vulnerability was used for ransomware.

Amadeus said it implemented measures to fix the vulnerability, added enhanced monitoring and detection, and is in direct dialogue with its customers and authorities. It declined to say whether the attackers have contacted the company or how many victims there are in total.

A detail that doesn't quite match

Amadeus calls the problem a vulnerability, but the airlines describe something different. Cathay Pacific said Amadeus told it that an unauthorized party gained access "using login credentials assigned to its system account." Korean Air gave customers a similar account, describing unauthorized access that used login credentials assigned to an account in the Amadeus system. Cathay also said Amadeus carried out a password reset as part of its response.

Those two descriptions are not necessarily in conflict. An attacker could have used stolen credentials to reach a booking-display system with a weakness in it. But the public record does not say which happened, how the credentials were obtained, or why the access appears to have gone unnoticed for about three years. The dates reported by JAL, Cathay and Malaysia Airlines all begin in August 2023 and end in September 2026.

Background: one supplier, many airlines

The Korea Times, in an analysis published Oct. 25, argued that the case shows how exposed airlines are to problems at their technology suppliers. Carriers have to share booking, ticketing and passenger data with travel agencies, partner airlines and other service providers to run international routes. Building all of those connections themselves would take substantial money and technical resources, so most rely on global platforms like Amadeus.

The tradeoff is a shared point of failure. When many carriers depend on one provider, one incident can reach customers of many different airlines at once. The Korea Times noted that a network failure at Amadeus in 2017 disrupted airport check-in services around the world, which showed how a single provider's problems can spread across carriers.

The Record added that Amadeus reported more than $6.5 billion in revenue last year and has deals with hundreds of airlines and airports. It also noted that dozens of airlines have been attacked over the past year, including Iberia and Air Côte d'Ivoire in 2026, and that hackers stole 6 million customer records from Australian airline Qantas last year, an incident that eventually led to its senior executives being fined hundreds of thousands of dollars.

Why booking details still matter

Airlines stress that no payment data was taken, and that is good news. But a booking reference, a name and a flight itinerary are useful to scammers. A criminal who knows when and where someone is flying, and on which airline, can send a convincing message pretending to be that airline about a delay, a refund or a change of seat.

That is why the airlines are repeating the same advice. JAL, which has contacted affected customers by email and set up a dedicated inquiry desk, asked customers to stay alert for phishing emails, fraudulent phone calls and fake websites imitating the JAL Group. Malaysia Airlines encouraged customers to be careful with suspicious or unsolicited communications, particularly any that ask for personal or financial information. Singapore Airlines is going a step further for travelers with imminent trips by replacing the booking references themselves, which makes any copied reference useless for changing a reservation.

The smaller group whose passport numbers and other travel-document details were exposed has more to worry about, because those details do not change and can be misused for identity fraud. The airlines have not said whether they will offer those customers any protection beyond a notification.

Analysis: the disclosure pattern is the story

The staggered announcements are telling. Amadeus told Korean Air about the incident on Oct. 20, JAL on Oct. 23, and Cathay on Oct. 28. Malaysia Airlines and Singapore Airlines went public on Nov. 1 and Nov. 3. Each airline has had to work out its own numbers from data Amadeus supplied, which suggests that the supplier, not the airlines, holds the full picture. Until Amadeus publishes a total, travelers will keep learning about the breach one carrier at a time.

For people in the Philippines, the reporting reviewed for this article did not name a Philippine airline among those affected. That could change as the investigation continues, and travelers who booked on any of the named carriers during the exposure window, which began in August 2023, are the ones with reason to check their messages.

What's next

• A total count: Amadeus has declined to say how many victims there are, so the full number of affected passengers and airlines is still unknown.
• Customer notices: JAL says it has already emailed affected customers, and Singapore Airlines is contacting travelers with upcoming trips.
• Answers about the intrusion: Amadeus has not explained how the credentials were obtained or how long the activity went undetected.
• Authorities: Amadeus says it is in direct dialogue with authorities. None of the sources reviewed describes any penalty or formal finding yet.

Sources

• The Record from Recorded Future News, "More Asian airlines announce data breaches after attack on Spanish IT provider Amadeus," Nov. 4, 2026: https://therecord.media/asian-airlines-announce-data-breach-it-provider-incident
• Cathay Pacific, "Personal data security incident involving a third-party service provider," Oct. 30, 2026: https://www.cathaypacific.com/cx/en_US/latest-news/security-and-operational-changes/personal-data-security.html
• Japan Airlines, "Regarding Unauthorized Access to Amadeus Passenger Service System and Our Response": https://www.jal.co.jp/en-jp/news/general/2026/other/261028.html
• Channel NewsAsia, "About 46,000 SIA booking records accessed in data breach involving travel tech company Amadeus," Nov. 3, 2026: https://www.channelnewsasia.com/singapore/sia-singapore-airlines-amadeus-data-breach-booking-records-6517151
• Channel NewsAsia, "Malaysia Airlines says customers may be affected by Amadeus breach," Nov. 1, 2026: https://www.channelnewsasia.com/asia/malaysia-airlines-amadeus-security-breach-6510631
• The Korea Times, "Korean Air breach exposes blind spot in airline cybersecurity," Oct. 25, 2026: https://www.koreatimes.co.kr/business/companies/20261025/korean-air-breach-exposes-blind-spot-in-airline-cybersecurity
• MoneyToday, "Customer personal information of Korean Air partner company leaked... including reservation numbers," Oct. 23, 2026: https://www.mt.co.kr/en/industry/2026/10/23/2026102320535149884