---
title: "Amadeus breach hit at least ten airlines through one booking system"
summary: "What Amadeus and the airlines disclosed from 23 October to 3 November: how one booking supplier exposed records at ten airlines, what was read, and why the counts cannot be added."
url: https://www.thetechbag.com/blog/amadeus-breach-airlines-one-supplier
format: Analysis
desk: "Security"
area: "Threats & vulnerabilities"
region: Global
published: 2026-11-05
facts_checked: 2026-11-05
author: TechBag (The TechBag Journal)
tags: ["Amadeus","passenger service system","airlines","Cathay Pacific","Japan Airlines","ANA","Singapore Airlines","Korean Air","Asiana","Malaysia Airlines","Qantas","third-party risk","supply chain","booking reference","phishing","SITA","Air India","DPDP","CERT-In"]
cover: https://www.thetechbag.com/blog/covers/amadeus-breach-airlines-one-supplier.png
---

# Amadeus breach hit at least ten airlines through one booking system

*What Amadeus and the airlines disclosed from 23 October to 3 November: how one booking supplier exposed records at ten airlines, what was read, and why the counts cannot be added.*

Analysis · Security · Threats & vulnerabilities · By TechBag · Published 2026-11-05 · Facts checked 2026-11-05 · Canonical: https://www.thetechbag.com/blog/amadeus-breach-airlines-one-supplier

The short version

1. Between 23 October and 3 November, ten airlines said passenger records held by one supplier, Amadeus, had been read by an unauthorised party: Korean Air, Asiana, Japan Airlines and Japan Transocean Air, ANA and three carriers that book through it, Cathay Pacific and Singapore Airlines. Malaysia Airlines says its customers may be affected; Qantas is checking.[6][7][3][5][2][10]
2. Most records held a name, a booking reference and flight details; where airlines split their counts, about 1% to 5% also held email, phone, passport or frequent-flyer numbers. Neither Amadeus nor any airline has found payment data. The four counts published come in three units (customers, bookings, booking records) and cannot be added.[1][3][4]
3. Amadeus describes “a vulnerability affecting a travel booking display environment”; Cathay, Korean Air and Asiana say the intruder used login credentials assigned to an Amadeus system account. A name and a booking reference are enough to open a booking online, which is why Singapore Airlines is changing references and the airlines warn of phishing.[1][2][17]

Amadeus, a Spanish company, runs the reservation systems of what Cathay Pacific calls “hundreds of airlines worldwide”.[2] In the first half of 2026, 1,089.1 million passengers boarded flights of airlines using at least its reservation and inventory modules or its Navitaire system, by Amadeus’s own count.[13] When something inside that supplier is misused, airlines learn second-hand, on the supplier’s timetable, and each tells its passengers in its own words. This piece puts the notices side by side: when each airline learned, how each describes the mechanism and the period, what each count measures, and what a passenger whose name and booking reference were read can do about it.

## Twenty-six days from detection to the first airline notice

According to ANA, Amadeus detected unauthorised third-party access to airline reservation information on 24 September, but did not report it to ANA that day. On 16 October ANA heard that another Amadeus airline had found unauthorised access and asked about its own flights; on 20 October Amadeus reported that access had been detected, and ANA informed Japan’s Personal Information Protection Commission, Aviation Wire reported.[5] Korean Air says it was “officially notified by Amadeus on October 20, 2026, at 22:44 KST”; Asiana gives 22:49 the same night. Both published notices on 23 October.[6][7] Japan Airlines and Japan Transocean Air were informed on 23 October and announced on 28 October; Cathay Pacific was notified on 28 October and received “further details” on 29 October.[3][5][2] Qantas, which has not said its passengers were affected, quoted Amadeus as saying “the issue was contained in September”.[12]

**Figure: Amadeus detected the access on 24 September; the airlines told passengers from 23 October to 3 November**

*Detection, notification of airlines and public disclosures in the Amadeus incident, 24 September to 3 November 2026*

| Date | Event | Detail |
| --- | --- | --- |
| 24 Sept 2026 | Amadeus detects access | ANA's account: Amadeus did not tell ANA that day |
| 20 Oct 2026 | First airlines told | Korean Air at 22:44 KST, Asiana at 22:49; ANA the same day, after asking on 16 October |
| 23 Oct 2026 | Korean Air, Asiana publish | Some booking references exposed; JAL and JTA informed the same day |
| 28 Oct 2026 | JAL announces; Cathay told | About 92,000 JAL and JTA customers |
| 29 Oct 2026 | ANA and three partners | AIRDO, Solaseed Air and StarFlyer hear from ANA |
| 30 Oct 2026 | Cathay and ANA counts | About 53,000 bookings; about 37,800 customers |
| 31 Oct 2026 | Malaysia Airlines | Customer information may be affected; no count |
| 3 Nov 2026 | Singapore Airlines | About 46,000 booking records |

Source: Airline notices (Korean Air, Asiana, JAL, ANA, StarFlyer, Cathay Pacific, Malaysia Airlines); ANA's account via Aviation Wire; SIA via CNA · as of 5 November 2026 · 24 September and the 20 October notice to ANA are ANA's account as reported by Aviation Wire

The regulators followed. Singapore’s Personal Data Protection Commission said on 4 November that it is investigating, and the Cyber Security Agency of Singapore said on 5 November that it is monitoring, The Straits Times reported. Cathay, Korean Air, Asiana and Singapore Airlines say they have informed their authorities; Qantas notified the Australian Cyber Security Centre.[11][2][6][7][12]

TechBag countTechBag count: the gaps

From Amadeus’s detection on 24 September to the first notifications on 20 October: 26 days. To Cathay’s notification on 28 October: 34 days. To Singapore Airlines’ statement on 3 November: 40 days. The dates are the airlines’; the intervals are ours. Amadeus has not published when it told each airline.

## One supplier under many airlines, and smaller airlines under those

Japan Airlines describes Amadeus as “the provider of our Passenger Service System (PSS) that integrates flight reservations, ticketing, and check-in procedures”.[3] Amadeus’s own definition of its Altéa PSS is a system “used by full-service airlines to manage core operations such as reservations, inventory, ticketing, and departure control”. ANA finished moving onto it in the first half of 2026, when its domestic operations transferred.[13] Some airlines reach Amadeus through another airline: AIRDO, Solaseed Air and StarFlyer use it via ANA, and learned of the incident from ANA on 29 October.[5][8] A StarFlyer passenger was therefore told by StarFlyer, which was told by ANA, which was told by Amadeus.

**Figure: A booking can pass through three companies, and the notice came back down the same chain**

*Where an affected booking sits, and how notice of the incident travelled, October and November 2026*

1. 01The passenger booksWith an airline or its partner. The booking, with its reference, lives in the airline’s passenger service system.
2. 02Amadeus holds the recordReservations, ticketing and check-in for the host airline; partners such as StarFlyer reach it through ANA, and JTA sits in JAL’s notice.
3. 03Something reads itA “booking display environment” with a vulnerability (Amadeus), or a system account’s login credentials (Cathay, Korean Air, Asiana).
4. 04The notice runs backAmadeus to the airline, the airline to its partners and regulators, then email to passengers: 20 October to 3 November.

Source: JAL, ANA, StarFlyer, Cathay Pacific and Korean Air notices; Amadeus statement and H1 2026 management review; Aviation Wire · as of 5 November 2026

It has happened before. On 4 March 2021, SITA, another airline IT supplier, confirmed a cyber-attack on servers of SITA Passenger Service System (US) Inc., which “operates passenger processing systems for airlines”.[15] Air India later said about 4.5 million of its customers were affected, with data registered between 26 August 2011 and 20 February 2021, including passport, ticket and credit-card details (but not CVV numbers), the BBC reported.[16] Singapore Airlines counted about 580,000 KrisFlyer and PPS members whose membership numbers and tier status were exposed.[11] The difference this time, on what has been published: neither Amadeus nor any airline has found evidence that payment data was accessed.

## Two accounts of how, and three readings of the same window

Amadeus’s statement is six sentences long. It does not use the words “credentials” or “account”, and it gives no count of airlines or passengers.[1] The airlines’ notices, written from what Amadeus told them, describe something more specific. They are set out below without reconciling them, because neither side has explained the other.

**Figure: Amadeus speaks of a display flaw; three airlines speak of a system account's login**

*How Amadeus and the airlines describe the mechanism and the containment, in their own words, October and November 2026*

Amadeus: a vulnerability

- “A vulnerability affecting a travel booking display environment”
- “Certain booking-display data was accessible through the vulnerability”
- “Measures to fix the vulnerability as well as enhanced monitoring and detection”
- “No indications that this vulnerability has been exploited for ransomware purposes”

The airlines: a system account's login

- Cathay: an unauthorised party “using login credentials assigned to its system account”
- Korean Air: “unauthorized access using credentials assigned to Amadeus’s system accounts”; Asiana the same
- Contained by “a password reset” (Cathay); the credentials “already invalidated” (ANA, StarFlyer)
- Amadeus is “blocking unauthorized access and initiating dark web monitoring” (Korean Air)

Source: Amadeus statement (October 2026); Cathay Pacific (30 October), Korean Air and Asiana (23 October), ANA and StarFlyer (30 October) · as of 5 November 2026 · ANA, StarFlyer and Asiana quotes translated by TechBag

The two may describe one event from two ends: a login can be the way into a display tool. But nobody has said whose account it was, how its credentials were obtained, or why one account could read several airlines’ bookings. No one has publicly attributed the access to anyone, and we do not speculate.[1][2][6][7][4][8]

The period is described three ways. JAL gives “August 10, 2023 – September 23, 2026” as the “period during which traces of external access were identified”.[3] ANA uses the same dates for something else: customers who booked in that period.[4] Cathay says the access “occurred between August 2023 and September 2026”; Korean Air says it is “estimated to have occurred” then, with the exact timing under investigation; Malaysia Airlines speaks of information “processed through Amadeus” in that period.[2][6][9] StarFlyer’s window starts later, with bookings from 28 July 2025.[8]

ReportedWhat no notice says

That an intruder was inside Amadeus continuously for three years. The window is when traces were found, or when the affected bookings were made or processed, depending on the airline. None says how often the account was used, or whether the access was continuous. The end date is consistent: 23 September in the Japanese notices, the day before ANA says Amadeus detected the access.[3][4][5]

## Three units, four counts, no total

Four airlines have published a number, and each counts something different. JAL and JTA count about 92,000 customers; ANA about 37,800 customers; Cathay about 53,000 bookings; Singapore Airlines about 46,000 booking records.[3][4][2][10] A booking can cover several passengers, and one passenger can hold several bookings, so the numbers cannot be summed into a count of people. Korean Air, Asiana, Malaysia Airlines, StarFlyer, AIRDO and Solaseed Air have given no count; StarFlyer says it is still checking.[6][7][9][5]

**Figure: Four airlines gave a count, in three different units, so there is no total**

*Records each airline says were accessed in the Amadeus incident, in the airline's own unit, as published 28 October to 3 November 2026*

JAL and JTA

customers

92,000

Cathay Pacific

bookings

53,000

Singapore Airlines

booking records

46,000

ANA

customers

37,800

|  | Value |
| --- | --- |
| JAL and JTA | 92,000 |
| Cathay Pacific | 53,000 |
| Singapore Airlines | 46,000 |
| ANA | 37,800 |

Source: JAL (30 October), Cathay Pacific (30 October), Singapore Airlines via CNA (3 November), ANA (30 October) · as of 5 November 2026 · Each bar is in its own unit; bars are not comparable as people and must not be added

TechBag countTechBag count: ten airlines, plus one that may be, plus one checking

Ten airlines have said their passengers’ records were accessed or showed traces of access: Korean Air, Asiana, Japan Airlines, Japan Transocean Air, ANA, AIRDO, Solaseed Air, StarFlyer, Cathay Pacific and Singapore Airlines. Malaysia Airlines says information “may have” been affected. Qantas is working with Amadeus “to understand the impact to any Qantas bookings”. We counted only airlines with their own notice or a named report of what they said; lists of 15 or more in some coverage include carriers we could not trace to either.[9][12]

## A name and a booking reference are enough to open a booking

For most passengers, what was read is short: JAL lists the reservation code, name, flight date, sector and class of service for about 90,000 of its 92,000; ANA the same five items for about 36,100 of 37,800; Singapore Airlines names, booking references, itineraries and booking classes.[3][4][10] A small subset had more: email address, phone number, passport or travel-document number, nationality and frequent-flyer number. Credit-card numbers and passwords were not among them, the Japanese airlines say.[3][4]

**Figure: At most one record in twenty also held contact or passport details**

*Share of each airline's affected records that also held email, phone, travel-document or frequent-flyer data, %, as published 30 October to 3 November 2026*

4.5%

ANA

about 1,700 of 37,800 customers

2.2%

JAL and JTA

about 2,000 of 92,000 customers

1.3%

Singapore Airlines

about 620 of 46,000 booking records

Source: JAL and ANA notices (30 October); Singapore Airlines via CNA (3 November); shares computed by TechBag · as of 5 November 2026 · JAL 2,000 of 92,000 customers; ANA 1,700 of 37,800 customers; SIA 620 of 46,000 booking records. Cathay gave no split

The short records still matter. Cathay’s own help page tells non-members to “simply provide your name and booking reference number or e-ticket number to retrieve your booking on Manage Booking”, where a booking can be changed or cancelled.[17] That is why Singapore Airlines is contacting customers with upcoming travel to change their booking reference numbers. Amadeus has confirmed that no booking was modified, the airline said; ANA says Amadeus found no evidence of data being altered or deleted.[10][5] The other risk is a message that already knows your flight. JAL asks customers “to remain vigilant against phishing emails, fraudulent phone calls, and suspicious websites impersonating the JAL Group”; Korean Air asks them to “refrain from clicking unfamiliar links”.[3][6]

Our viewOur view: what to do if you booked with these airlines

If the airline offers a new booking reference, take it. Treat any email, text or call that quotes your flight or reference as unverified, and reach the booking through the airline’s own app or site, typed in, not a link. None of the notices asks passengers to pay or to confirm card details. If you are in the small group whose frequent-flyer number was read, check the account’s statement. What to watch: counts from the six airlines that have not given one, and Amadeus’s third-quarter results, scheduled for 6 November.[14]

India: no Indian airline has reported exposure, and the law makes the airline answer for its supplier

As of 7pm IST on 5 November, no Indian airline has said its passengers’ records were part of this incident, in any notice or report we read. Indians who booked with Korean Air, Asiana, JAL, ANA, Cathay Pacific, Malaysia Airlines or Singapore Airlines between August 2023 and September 2026 are covered by those airlines’ notices like anyone else; Cathay carries its notice on its India site. India’s own precedent is Air India’s 4.5 million customers in the 2021 SITA case.[2][16]

Under the Digital Personal Data Protection Act, 2023, the airline, not its supplier, carries the duty: a data fiduciary must protect personal data “including in respect of any processing undertaken by it or on its behalf by a Data Processor”, and must tell the Data Protection Board and each affected person of a breach (section 8(5) and 8(6)).[18] The breach-reporting rule under the DPDP Rules, 2025 (Rule 7) applies from 13 May 2027.[19] Today, CERT-In’s Directions of 28 April 2022 already require any service provider, intermediary, data centre, body corporate or government organisation to report a “Data Breach” or “Data Leak” within six hours of noticing it.[20] The phishing guidance above applies unchanged; the [email security guide](https://www.thetechbag.com/browse/security/email-security) compares the filters that catch such messages, and [third-party management tools](https://www.thetechbag.com/onetrust/onetrust-third-party-management) keep the register of which supplier holds which data.

How we did this

Figures as of 5 November 2026, 7pm IST

Counts, data types, dates and mechanism descriptions are from each airline’s own notice and Amadeus’s statement, read in full; ANA, StarFlyer and Asiana were read in Japanese and Korean and are quoted in our translation. Singapore Airlines’ figures are from its 3 November media statement as CNA and The Straits Times reported it, because we found no statement on its website. Amadeus’s 24 September detection and the 16 and 20 October steps are ANA’s account as Aviation Wire reported it; AIRDO and Solaseed Air are as Aviation Wire reported them; Qantas is as Australian Aviation reported it. Counts are never added: they are in three units. Shares in the Waffle are each airline’s subset divided by its own total. The airline count includes only carriers with their own notice or a named report of their statement. Not used: coverage that lists Condor and others without a source we could trace, and any attribution of the access.

Spotted an error? Write to us; corrections are published at the foot of the piece.

Sources

1. [Amadeus, Data and Vulnerability Statement](https://amadeus.com/en/industry-messaging/amadeus-statement-oct) — October 2026 Text last modified 2 November 2026.
2. [Cathay Pacific, Personal data security incident involving a third-party service provider](https://www.cathaypacific.com/cx/en_AU/latest-news/security-and-operational-changes/personal-data-security.html) — 30 October 2026, 16:11 HKT
3. [Japan Airlines and Japan Transocean Air, Regarding Unauthorized Access to Amadeus Passenger Service System and Our Response](https://www.jal.co.jp/en-jp/news/general/2026/other/261028.html) — 30 October 2026 First announced 28 October (Aviation Wire).
4. [ANA, Amadeus社 旅客サービスシステムへの不正アクセスについて (Unauthorised access to Amadeus's passenger service system)](https://www.ana.co.jp/ja/jp/special-notice/001612.html) — 30 October 2026 Japanese; quoted in TechBag's translation.
5. [Aviation Wire, ANA、不正アクセス影響3.8万人 1700人はパスポート番号も＝アマデウス問題 (ANA: 38,000 affected, 1,700 with passport numbers)](https://www.aviationwire.jp/archives/353359) — 30 October 2026
6. [Korean Air, notice on a potential personal data security incident at Amadeus](https://www.koreanair.com/contents/footer/customer-support/notice/2026/2610-Amadeus) — 23 October 2026
7. [Asiana Airlines, 일부 고객 개인정보(예약번호) 유출 안내 (Notice of leak of some customers' booking numbers)](https://flyasiana.com/C/KR/KO/customer/notice/detail?id=CM202610230002530882) — 23 October 2026 Korean; quoted in TechBag's translation.
8. [StarFlyer, Amadeus社が提供する旅客サービスシステムへの不正アクセスについて (Unauthorised access to the Amadeus passenger service system)](https://www.starflyer.jp/news/2026/news_20261029_info.html) — 29 October 2026, updated 30 October 2026 Japanese; quoted in TechBag's translation.
9. [Malaysia Airlines, Cybersecurity incident involving third-party technology provider](https://www.malaysiaairlines.com/my/en/mh-media-centre/important-for-you/cybersecurity-incident-third-party-technology-provider.html) — 31 October 2026
10. [CNA, About 46,000 SIA booking records accessed in data breach involving travel tech company Amadeus](https://www.channelnewsasia.com/singapore/sia-singapore-airlines-amadeus-data-breach-booking-records-6517151) — 3 November 2026
11. [The Straits Times, About 46,000 SIA booking records accessed illegally in data breach affecting software provider Amadeus](https://www.straitstimes.com/singapore/46000-sia-booking-records-accessed-illegally-in-data-breach-affecting-software-provider-amadeus) — 3 November 2026, updated 5 November 2026
12. [Australian Aviation, Qantas customer data possibly exposed in Amadeus hack](https://australianaviation.com.au/2026/11/qantas-customer-data-possibly-exposed-in-amadeus-hack/) — 2 November 2026
13. [Amadeus, Management review, results for the six months ended 30 June 2026 (passengers boarded; Altéa PSS; ANA migration)](https://amadeus.com/content/dam/amadeus/corporate/documents/en/investors/2026/results/h1/h1-2026-management-review.pdf) — 31 July 2026
14. [Amadeus, Investors page (Q3 2026 results, 6 November 2026)](https://corporate.amadeus.com/en/investors) — November 2026
15. [SITA, SITA statement about security incident](https://www.sita.aero/pressroom/news-releases/sita-statement-about-security-incident/) — 4 March 2021
16. [BBC News, Air India cyber-attack: Data of millions of customers compromised](https://www.bbc.com/news/world-asia-india-57210118) — 22 May 2021
17. [Cathay Pacific, Manage Booking (India site): retrieving a booking with name and booking reference](https://www.cathaypacific.com/cx/en_IN/manage-booking.html) — undated help page
18. [Digital Personal Data Protection Act, 2023, section 8(5) and 8(6)](https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf) — 11 August 2023
19. [MeitY, Digital Personal Data Protection Act, 2023 and DPDP Rules, 2025 (notified 13 November 2025; Rule 7 from 13 May 2027)](https://www.meity.gov.in/data-protection-framework) — 13 November 2025
20. [CERT-In, Directions under section 70B(6) of the IT Act (six-hour reporting; Annexure I items xi and xii, Data Breach and Data Leak)](https://www.cert-in.org.in/PDF/CERT-In_Directions_70B_28.04.2022.pdf) — 28 April 2022

Related on TechBag: the [privileged access guide](https://www.thetechbag.com/browse/identity-access/privileged-access-management), on the controls for system and service accounts.

**Disclosure.** TechBag is a software reseller: it earns a margin when a reader buys through it, including from vendors named here. The analysis is TechBag’s own; no vendor paid for or saw this piece before publication. Facts are labelled reported, TechBag count or our view.

**Read this next:** [Crédit Mutuel Arkéa: its own money, not customers’, left through a supplier’s platform](https://www.thetechbag.com/blog/credit-mutuel-arkea-own-funds-supplier-platform) — Another supplier as the way in, the same week: Crédit Mutuel Arkéa says its own money, not customers’, left through a supplier’s platform.

Go deeper on TechBag

- [Privileged access management guide](https://www.thetechbag.com/browse/identity-access/privileged-access-management) — the controls on system and service accounts, the kind of login the airlines describe
- [Email security guide](https://www.thetechbag.com/browse/security/email-security) — the filters that catch phishing which quotes a real booking
- [OneTrust Third-Party Management](https://www.thetechbag.com/onetrust/onetrust-third-party-management) — a register of which supplier holds which customer data