Amadeus breach hit at least ten airlines through one booking system

01Twenty-six days from detection to the first airline notice

According to ANA, Amadeus detected unauthorised third-party access to airline reservation information on 24 September, but did not report it to ANA that day. On 16 October ANA heard that another Amadeus airline had found unauthorised access and asked about its own flights; on 20 October Amadeus reported that access had been detected, and ANA informed Japan’s Personal Information Protection Commission, Aviation Wire reported.⁵ Korean Air says it was “officially notified by Amadeus on October 20, 2026, at 22:44 KST”; Asiana gives 22:49 the same night. Both published notices on 23 October.⁶⁷ Japan Airlines and Japan Transocean Air were informed on 23 October and announced on 28 October; Cathay Pacific was notified on 28 October and received “further details” on 29 October.³⁵² Qantas, which has not said its passengers were affected, quoted Amadeus as saying “the issue was contained in September”.¹²

The regulators followed. Singapore’s Personal Data Protection Commission said on 4 November that it is investigating, and the Cyber Security Agency of Singapore said on 5 November that it is monitoring, The Straits Times reported. Cathay, Korean Air, Asiana and Singapore Airlines say they have informed their authorities; Qantas notified the Australian Cyber Security Centre.^1126712

02One supplier under many airlines, and smaller airlines under those

Japan Airlines describes Amadeus as “the provider of our Passenger Service System (PSS) that integrates flight reservations, ticketing, and check-in procedures”.³ Amadeus’s own definition of its Altéa PSS is a system “used by full-service airlines to manage core operations such as reservations, inventory, ticketing, and departure control”. ANA finished moving onto it in the first half of 2026, when its domestic operations transferred.¹³ Some airlines reach Amadeus through another airline: AIRDO, Solaseed Air and StarFlyer use it via ANA, and learned of the incident from ANA on 29 October.⁵⁸ A StarFlyer passenger was therefore told by StarFlyer, which was told by ANA, which was told by Amadeus.

It has happened before. On 4 March 2021, SITA, another airline IT supplier, confirmed a cyber-attack on servers of SITA Passenger Service System (US) Inc., which “operates passenger processing systems for airlines”.¹⁵ Air India later said about 4.5 million of its customers were affected, with data registered between 26 August 2011 and 20 February 2021, including passport, ticket and credit-card details (but not CVV numbers), the BBC reported.¹⁶ Singapore Airlines counted about 580,000 KrisFlyer and PPS members whose membership numbers and tier status were exposed.¹¹ The difference this time, on what has been published: neither Amadeus nor any airline has found evidence that payment data was accessed.

03Two accounts of how, and three readings of the same window

Amadeus’s statement is six sentences long. It does not use the words “credentials” or “account”, and it gives no count of airlines or passengers.¹ The airlines’ notices, written from what Amadeus told them, describe something more specific. They are set out below without reconciling them, because neither side has explained the other.

The two may describe one event from two ends: a login can be the way into a display tool. But nobody has said whose account it was, how its credentials were obtained, or why one account could read several airlines’ bookings. No one has publicly attributed the access to anyone, and we do not speculate.¹²⁶⁷⁴⁸

The period is described three ways. JAL gives “August 10, 2023 – September 23, 2026” as the “period during which traces of external access were identified”.³ ANA uses the same dates for something else: customers who booked in that period.⁴ Cathay says the access “occurred between August 2023 and September 2026”; Korean Air says it is “estimated to have occurred” then, with the exact timing under investigation; Malaysia Airlines speaks of information “processed through Amadeus” in that period.²⁶⁹ StarFlyer’s window starts later, with bookings from 28 July 2025.⁸

04Three units, four counts, no total

Four airlines have published a number, and each counts something different. JAL and JTA count about 92,000 customers; ANA about 37,800 customers; Cathay about 53,000 bookings; Singapore Airlines about 46,000 booking records.³⁴²¹⁰ A booking can cover several passengers, and one passenger can hold several bookings, so the numbers cannot be summed into a count of people. Korean Air, Asiana, Malaysia Airlines, StarFlyer, AIRDO and Solaseed Air have given no count; StarFlyer says it is still checking.⁶⁷⁹⁵

05A name and a booking reference are enough to open a booking

For most passengers, what was read is short: JAL lists the reservation code, name, flight date, sector and class of service for about 90,000 of its 92,000; ANA the same five items for about 36,100 of 37,800; Singapore Airlines names, booking references, itineraries and booking classes.³⁴¹⁰ A small subset had more: email address, phone number, passport or travel-document number, nationality and frequent-flyer number. Credit-card numbers and passwords were not among them, the Japanese airlines say.³⁴

The short records still matter. Cathay’s own help page tells non-members to “simply provide your name and booking reference number or e-ticket number to retrieve your booking on Manage Booking”, where a booking can be changed or cancelled.¹⁷ That is why Singapore Airlines is contacting customers with upcoming travel to change their booking reference numbers. Amadeus has confirmed that no booking was modified, the airline said; ANA says Amadeus found no evidence of data being altered or deleted.¹⁰⁵ The other risk is a message that already knows your flight. JAL asks customers “to remain vigilant against phishing emails, fraudulent phone calls, and suspicious websites impersonating the JAL Group”; Korean Air asks them to “refrain from clicking unfamiliar links”.³⁶