Malaysia Airlines warned on Nov. 1 that an Amadeus data breach may have affected customer information processed through its reservation provider between August 2023 and September 2026. The flag carrier said its own information technology systems were not breached and that there was no evidence financial information had been accessed. The notice adds the airline to a group of carriers that have reported customer data compromised through the same travel-technology vendor.
Key Takeaways
- Malaysia Airlines says data processed from August 2023 to September 2026 may be affected.
- Carrier says its IT systems were not breached; no evidence financial data was accessed.
- Cathay reported about 53,000 bookings; JAL about 92,000; ANA up to 37,800.
- Amadeus did not respond when asked how many customers’ data were affected.
What Carriers Say the Amadeus Data Breach Affected
According to Channel NewsAsia, Malaysia Airlines said some customer information may have been affected by a cybersecurity incident involving Amadeus, its reservation-technology provider. The carrier is working with Amadeus and relevant parties to investigate the incident and assess its impact. It encouraged customers to remain vigilant against suspicious or unsolicited communications, particularly those requesting personal or financial information.
The Straits Times reported that Cathay Pacific, in a statement on Oct. 30, described unauthorised access to reservation data held by Amadeus IT Group over that same window. Most affected Cathay records contained booking references, passenger names and flight details. A smaller subset potentially included email and phone contacts and travel document information.
Cathay said the incident is being investigated and is not affecting its systems or operations. That wording is narrower than a finding that the airline’s own IT systems were not breached.
Which Airlines Have Reported Impact
Channel NewsAsia said Malaysia Airlines joins Cathay Pacific Airways, Japan Airlines, South Korea’s Asiana Airlines and others that reported customer data compromised in the breach. The Straits Times added ANA Holdings, Korean Air Lines and German carrier Condor. It is unclear whether more airlines are affected.
Amadeus software is used extensively by the global aviation industry. Deutsche Lufthansa, which entered a partnership with Amadeus in 2026, did not immediately reply to a request for comment, The Straits Times reported.
| Carrier | What was reported | Scale disclosed |
|---|---|---|
| Cathay Pacific | Bookings with names and flight details; some contact or travel-document data | About 53,000 bookings |
| Japan Airlines | Customer records exposed | Around 92,000 |
| ANA Holdings | Passenger information leaked | Up to 37,800 passengers |
| Malaysia Airlines | Some customer information may be affected; no evidence financial data was accessed | Not disclosed |
Asiana Airlines, Korean Air Lines and Condor have also said data was affected, though neither report gives counts for them. The Straits Times reported Japan Airlines said around 92,000 customer records were exposed in a cyberattack. Channel NewsAsia put the Japan Airlines figure at 92,000 customers.
Cathay’s count is bookings, not unique passengers, so the figures are not directly comparable.
What Amadeus Has Confirmed So Far
Amadeus said it had become aware of a vulnerability affecting a travel booking display environment, Channel NewsAsia reported. It did not respond to a question on how many customers’ data were affected. In this newsroom’s reading, that leaves security teams with carrier-level notices and no vendor-wide total.
Malaysia Airlines said its information technology systems were not breached. Cathay said the incident is not affecting its systems or operations. Those statements do not mean passenger data held by Amadeus was unaffected.
Cathay described unauthorised access to reservation data held by Amadeus. Malaysia Airlines said information processed through the provider may have been affected over the same period.
What Security Teams Should Do Now
The near-term risk, in our assessment, is social engineering built from booking details rather than misuse of financial data. Malaysia Airlines said there was no evidence financial information had been accessed. Cathay’s smaller subset may still include email, phone and travel document details, which can make unsolicited requests look plausible.
Leaders who depend on shared reservation platforms should treat the event as a supplier notification, not as proof the airline perimeter held. Actions that follow from what carriers have already disclosed:
- Confirm whether Amadeus processed your passenger data between August 2023 and September 2026.
- Ask which booking-display environments were vulnerable and which fields — names, contacts, travel documents — were in scope.
- Brief customer teams to watch for suspicious requests for personal or financial information, as Malaysia Airlines urged.
- Keep a claim that an airline’s systems were not breached separate from any claim that customer data was not affected.
- Compare peer notices carefully; published counts cover only some airlines and use different units.
Teams already running large breach notifications, including a DHS employee-records exposure, face a similar scope problem: do not promise a complete affected list before the vendor states it. Until Amadeus responds on how many customers’ data were affected, plan communications around the record types already described.
