Unauthorised access to airline reservation data held by travel technology provider Amadeus IT Group was disclosed by five airline groups in late October 2026. Cathay Pacific, Japan Airlines and Japan Transocean Air, All Nippon Airways, Korean Air and Asiana Airlines each disclosed exposure of reservation data held by Amadeus, and the disclosures describe a supplier side incident rather than a breach of each airline's own systems. The figures in the disclosures count different things, so no consistent industry wide total exists: Cathay Pacific reported about 53,000 bookings affected, Japan Airlines and Japan Transocean Air reported about 92,000 customers affected, All Nippon Airways reported about 37,800 customers affected, and Korean Air and Asiana Airlines disclosed booking information exposure without giving an overall customer count. The figures are stated separately in this article and are never added together, and the same passenger could appear in more than one airline's figures.
Shared supplier incident
The common thread in the disclosures is unauthorised access to reservation data held by Amadeus, in several notices described as access by a party using login credentials assigned to an Amadeus system account. Cathay Pacific said it was notified by Amadeus on 2026-10-28 and received further details on 2026-10-29, according to the Business Times report on Cathay's statement. Amadeus described a different part of the incident in its own statement, saying it found a vulnerability affecting a travel booking display environment, invalidated the relevant credentials, strengthened monitoring, found no evidence that payment or financial data was accessed, and is still investigating. The sources reviewed do not explain how the credential misuse described by the airlines relates to the display environment vulnerability described by Amadeus, so both descriptions are reported here as attributed claims and no single confirmed mechanism is presented. No ransomware indication was reported in the sources reviewed.
Cathay Pacific
Cathay Pacific said on 2026-10-30 that about 53,000 bookings were affected by unauthorised access to Amadeus reservation data between August 2023 and September 2026, according to the Straits Times report. Most records held passenger names, booking references and flight details, while a smaller subset may also include email addresses, phone contacts, travel document details and frequent flyer numbers. Cathay did not state how many bookings fall in that smaller subset, so the number of affected email addresses at Cathay is not stated in the disclosure. Cathay said there is no evidence that financial or payment information was accessed and no evidence that the affected data was misused, that the incident has not affected its own systems or operations, that it informed the relevant authorities, and that it will notify affected customers individually once the relevant details are established.
Japan Airlines and Japan Transocean Air
Japan Airlines and Japan Transocean Air disclosed on 2026-10-28 that about 92,000 customers were affected, after Amadeus notified Japan Airlines on 2026-10-23, according to the SecurityScorecard analysis of the Japan Airlines disclosure. Unauthorised access to the Passenger Service System covered records from 10 August 2023 to 23 September 2026. Most records held names, booking references, travel dates, flight sectors and cabin classes, while about 2,000 customers had additional contact and passport information exposed. Japan Airlines said no credit card numbers or passwords were compromised, that flight operations were unaffected, and that it will contact affected customers individually. Japan Airlines also warned about phishing emails, fraudulent calls and websites impersonating the Japan Airlines Group.
All Nippon Airways
All Nippon Airways issued an initial notice on 2026-10-29 that some passenger information may have been viewed, and disclosed figures on 2026-10-30: about 37,800 customers in total, according to the Abijita report on ANA's disclosure. About 36,100 customers had names, booking references, travel dates, flight routes and cabin classes accessed. About 1,700 customers had additional details exposed, including email addresses, phone numbers, passport numbers, nationalities, frequent flyer numbers, e-ticket numbers and seat numbers. ANA said payment card details and account passwords were not involved, that no evidence of misuse had been reported, and that it plans to contact affected customers directly. ANA warned passengers about phishing emails, phone calls, websites and social media advertisements impersonating the airline.
Korean Air and Asiana Airlines
Korean Air and Asiana Airlines were notified by Amadeus on 2026-10-20 and issued alerts on 2026-10-23, according to the Japan Cyber Watch summary of the Amadeus disclosures. Booking information was exposed, including booking reference numbers, while other data items were still being verified with Amadeus at the time of the alerts. Neither airline disclosed an overall customer count, and no full list of exposed data items was given for either airline. Both airlines said there was no evidence that their own internal databases were intruded into, and no secondary damage was reported at the time of the alerts. Asiana said payment related information was not included.
Data reported as not accessed
Across the disclosures, the airlines and Amadeus reported no evidence that payment card or financial data was accessed. Cathay Pacific, Japan Airlines and ANA each stated that payment details were not involved, and Japan Airlines stated that passwords were not compromised. Cathay, Japan Airlines and ANA each stated that no evidence of misuse had been identified at the time of their notices, while the investigations continue. Flight operations were reported as unaffected by Japan Airlines, and Cathay stated that its own systems and operations were unaffected. These statements describe the position at the time of each notice, not a final finding, because Amadeus said its investigation is continuing.
Separate incident and unconfirmed reporting
Jin Air is not part of the Amadeus incident. Its incident was a separate external attack on its own member information lookup API, confirmed on 2026-10-28 and disclosed on 2026-10-29, affecting 1,454 members, with email addresses among the items exposed, according to the Travel Weekly Asia report. It is noted here only so readers do not conflate the two incidents. Wider reporting that German carrier Condor was also affected remains unconfirmed in the sources reviewed, and Lufthansa did not immediately reply to a request for comment in the Straits Times report cited above. Neither airline is presented here as a confirmed victim of the same incident.
Booking and itinerary phishing risk
The risk described by the airlines is impersonation phishing. A message that quotes a real passenger name, booking reference and flight is harder to dismiss than a generic scam message, and the exposed records give an attacker exactly those details. The airlines described the same pattern in their warnings: suspicious messages impersonating the airline, links of unclear origin, attachments, and requests to enter personal information are to be treated as suspect. The airlines advised affected passengers to verify any booking related request through official airline channels rather than through links or contact details in an unsolicited message, and to watch for booking or itinerary messages that arrive outside a booking the passenger made. Passengers whose passport details were exposed face a higher risk, because a passport number combined with a name, nationality and contact details supports impersonation and targeted fraud. How phishing uses a leaked email address explains the mechanism in detail.
Your address is probably in this file. Check whether it is, apply the booking verification checks described above, and then fix the part you control: the address you hand out next time. One AliasFleet alias per service means the next leak can only point back to the service that leaked it. Founders Club is $7 a month, locked forever, instead of $12. Early members only.
Investigation status and open questions
Amadeus said its investigation is continuing and that it has implemented fixes and additional monitoring while working with customers and authorities. The airlines said they will contact affected customers individually as details are confirmed. Amadeus has not published a list of affected airlines or a consistent industry wide total, and no notice reviewed here states who used the credentials or how they were obtained. Further disclosures may revise the figures in this article, and any such update will be reported as a dated follow up rather than a silent change to the figures above. A separate alias for each booking limits what a supplier side exposure hands over. Using email aliases for travel bookings describes that approach: the alias used for a booking is the address a supplier holds, so a leak from that supplier exposes that alias rather than a primary inbox address, and the alias can be paused or replaced without changing the primary address.
Top comments (0)