Amadeus Breach Exposes Passport Data at Japan Airlines, ANA and Cathay

The Amadeus data breach reached one more airline on Saturday, when Malaysia Airlines warned customers that booking data processed through the vendor’s system between August 2023 and September 2026 may have been affected. Its advisory puts it alongside Cathay Pacific, Japan Airlines, ANA, Korean Air and Asiana, all of which have confirmed some level of impact. This is a supply-chain breach, and it was still spreading as of November 1.

Amadeus is a Madrid-headquartered company that runs reservation and booking systems for airlines, hotels and agencies, according to its Wikipedia profile. BleepingComputer describes its reach as more than 400 airlines, 210 airport operators, 34 cruise and ferry lines and 2 million hotels. When one vendor sits behind that many booking systems, a single weakness can expose records for many companies at once.

What happened and when

According to Heise, Amadeus had been alerted to a “potential vulnerability” on September 21, and booking data may have been viewable through it. The company said it had since fixed the flaw, which “affected a display environment for travel bookings.”

Amadeus went public on October 1 and said it had found a vulnerability in a travel booking display environment that could expose traveler data. At that time it said ransomware actors had not exploited the flaw and that no payment data was exposed. Much of the detail since then has come from the airlines rather than from Amadeus.

Japan Airlines says Amadeus notified it on October 23 that unauthorized access ran from August 10, 2023 to September 23, 2026, as BleepingComputer reported. JAL announced on October 28 that about 92,000 customers were affected. Cathay Pacific says it was informed on October 28 and disclosed the incident on October 30. Malaysia Airlines followed on October 31, and a roundup of carrier statements has since named more carriers.

Which airlines are affected by the Amadeus data breach

Japan Airlines and ANA have published the most specific figures so far. Cathay Pacific has also given a booking count. The table below summarizes what each carrier has reported.

The roundup named seven airlines in total, adding Japan Transocean Air and Star Flyer to the list. Amadeus has not said how many airlines or customers were affected overall, and investigations are ongoing. Any combined total you see in a headline is a sum of carrier disclosures, not an official Amadeus count.

What data was exposed, and what was not

Japan Airlines says the records for about 90,000 customers covered reservation codes, names, flight dates, routes and travel classes. About 2,000 more customers had contact details, passport numbers, nationalities and frequent-flyer numbers exposed. ANA reports that passport numbers and nationalities were exposed for 1,700 of its affected customers.

Cathay Pacific’s disclosure is the reassuring part. Most of its 53,000 affected bookings contained a booking reference, name and flight details, and a smaller group held additional personal data. The airline said there was “no evidence that financial or payment information was accessed,” as FTN News reported, citing Reuters.

The distinction matters. A name, booking reference and itinerary are enough to write a believable message about a seat change or a delayed flight. A passport number adds an identity document detail that is far harder to change than a password, and it can make an impersonation attempt look routine. Malaysia Airlines has not published a count, but its warning focused on unsolicited messages and phishing.

Why a vendor breach reaches so many airlines

The access path is the part still unresolved. JAL says the unauthorized access used login credentials tied to an Amadeus system account, as Japan Cyber Watch reported. The root cause has not been publicly detailed, and none of the reporting so far identifies a CVE number for the flaw.

Shared infrastructure multiplies the damage. One weak account at a vendor can open records belonging to dozens of carriers, and each carrier then has to investigate and notify its own customers. Industry data points the same way. Kroll’s Data Breach Outlook 2026 found that nearly seven in ten people affected by breaches it handled were exposed through an outside supplier.

USA 24 has seen a similar lesson in a different sector, from the CitySourced database that exposed 42 million documents. The data was held by a third party, and the people it described had little say in how it was protected.

What US travelers should check now

No US airline has been confirmed as affected in the sources reviewed. The named carriers are Asian airlines, so the direct exposure falls on their customers. That does not rule out American travelers. Anyone who booked a trip with one of the named carriers, or on a flight where Amadeus powers the booking, should check their records.

• Check whether you flew or booked with any named airline between August 2023 and September 2026.
• Treat unexpected emails, texts or calls about a trip with suspicion, even if they quote your flight or booking reference. Those details alone do not prove a legitimate sender.
• Never share passport, payment or personal details in reply to an unsolicited message. Contact the airline through its official app or website instead.
• If a passport number may have been exposed, watch your accounts for suspicious activity. Ask the airline itself for specifics, since Amadeus is not the contact point for individual records.

Travel companies that rely on Amadeus or similar vendors should take a different set of steps. Review third-party access logs, look for credentials that stayed active long after they were needed, and check vendor notification clauses. The disclosed window of nearly three years is the detail that should worry them most.

How this compares with earlier Amadeus and SITA incidents

This is not the first time Amadeus booking systems have drawn scrutiny. In January 2019, researcher Noam Rotem found a flaw that let people view and alter flight bookings across roughly 140 airlines. United, Lufthansa and Air Canada were among the customers named at the time, according to BleepingComputer’s 2019 report. Heise also noted that the 2019 flaw exposed booking data for 141 airlines.

The closest US precedent is the 2021 SITA passenger-system hack. United and American confirmed that some customer data was taken in that incident, as TechCrunch reported.

The mechanism is what separates this case from 2019. The earlier problem was a software weakness that let outsiders view bookings. The 2026 case, as the airlines describe it, involves credentials for a system account and an access window that stretched across three years. That points to account controls and monitoring at least as much as to code.

What to watch next

Four questions will shape how far this goes. The first is whether any US carrier confirms exposure. The second is whether the leaked records surface in phishing or fraud. JAL says it has no evidence of misuse, and Malaysia Airlines is warning as a precaution. The third is how the attacker obtained the credentials and how long access lasted. The fourth is whether privacy regulators in Asia or Europe open formal inquiries, which has not been confirmed in the sources reviewed.

Watch for Amadeus to publish a count of affected airlines and passengers, and for Korean Air and Asiana to release figures of their own. Each new carrier notice fills in a piece of the picture. If the disclosures keep pointing to the same account and the same window, the story will be less about one flawed screen and more about how much trust the industry places in a single vendor.