NewsCompaniesFlawsGuides
Get the app
HighUpdated

Amadeus breach exposes airline booking details and some passengers’ passport numbers

Unauthorised access at Amadeus exposed airline booking data, including some passport numbers. JAL reports 92,000 affected customers, ANA 37,800 and Cathay 53,000 bookings. Check airline notices and verify unexpected travel messages directly.

What to do

No device update is required; Amadeus handled the system changes. Check your airline’s official notice or contact it directly to establish whether your booking and travel-document details were affected. Verify unexpected travel emails, calls or requests for personal or financial information through the airline’s official website or app.

What’s happening

Unauthorised access to Amadeus’s airline reservation systems exposed passenger names, booking references and flight details. JAL identified traces of access between 10 August 2023 and 23 September 2026. Japan Airlines and Japan Transocean Air reported approximately 92,000 affected customers, ANA approximately 37,800, and Cathay Pacific approximately 53,000 bookings; these are different measures and should not be added as a passenger total. Some records also contained contact details, passport or other travel-document information and frequent flyer numbers. Cathay said the intruder used credentials assigned to an Amadeus system account. Amadeus says it implemented measures to fix the vulnerability; airline notices describe credential revocation or a password reset and stronger monitoring. Amadeus found no evidence of financial-data access or ransomware use. As at 3 November, investigations remained open: JAL had emailed affected customers, while Cathay and ANA planned notifications. JAL and Cathay reported no identified misuse of the exposed information.

What
Breach
Affects
Amadeus airline reservation systems
Fixed in
Nothing to patch
Since
1 Oct 2026

Timeline

  1. Update

    PhocusWire reported further airline disclosures, including Malaysia Airlines saying customer information may have been affected. The overall scope remained unsettled, with Qantas investigating whether its bookings were involved.

  2. Update

    ANA identified approximately 37,800 affected customers, including about 1,700 whose potentially exposed information included passport numbers. It said compromised credentials had been revoked and affected customers would be contacted.

  3. Update

    Cathay Pacific disclosed about 53,000 affected bookings, containment including a password reset, and plans for individual notifications. It dates access to August 2023–September 2026 and notification to 28 October; Reuters instead described 28 October as the breach date.

  4. Update

    JAL's updated notice identified approximately 92,000 affected customers, including about 2,000 with additional information such as passport numbers exposed. It said affected customers had been emailed and no misuse had been identified.

  5. Update

    Amadeus notified Japan Airlines and Japan Transocean Air that unauthorised access had exposed some customer reservation data.

  6. Made publicNothing to patch

    Amadeus published a statement about a vulnerability exposing booking-display data, according to BleepingComputer. Amadeus said it had implemented corrective measures and found no evidence of payment or financial data access.

  7. Update

    The access period identified in JAL's notice ended. This date does not establish when Amadeus completed its security measures.

  8. Update

    The period in which Japan Airlines and Japan Transocean Air later identified traces of external access to reservation records began.

Sources

  1. Amadeus StatementAmadeus · 1 Oct 2026
  2. Regarding Unauthorized Access to Amadeus Passenger Service System and Our ResponseJapan Airlines · 30 Oct 2026
  3. Personal data security incident involving a third-party service providerCathay Pacific · 30 Oct 2026
  4. Regarding Unauthorized Access to Passenger Service System Provided by AmadeusAll Nippon Airways · 30 Oct 2026
  5. Cybersecurity Incident Involving Third-Party Technology ProviderMalaysia Airlines
  6. Japan Airlines suffers third-party data breach exposing passenger infoBleepingComputer · 29 Oct 2026
  7. Cathay Pacific says Amadeus breach affected 53,000 bookingsReuters via CNA · 30 Oct 2026
  8. Amadeus data breach affects multiple airline partnersPhocusWire · 2 Nov 2026
HARD Live follows this until it’s over: each change is added to the timeline with its source. Everything live · Everything from October 2026 · JSON · RSS