Amadeus Data Breach: Which Airlines Are Affected and What Travelers Should Do

Last updated: November 4, 2026. By Veer. Facts checked against the official notices from Japan Airlines, ANA, Cathay Pacific, Star Flyer and Malaysia Airlines, plus reporting by Reuters, Bloomberg via The Straits Times, The Business Times, Seoul Economic Daily and heise online. This is a researched explainer. We’ll update it as more airlines report.

Update (November 4, 2026): Singapore Airlines said on November 3 that data from about 46,000 SIA booking records was accessed in the Amadeus incident: names, booking reference numbers, travel itineraries and booking classes. For about 620 of those records, email addresses, phone numbers, travel document details and KrisFlyer membership numbers may also have been accessed. SIA says its own IT systems weren’t breached, and Amadeus confirmed no bank account or card details were exposed and no bookings were changed. SIA is contacting affected customers with upcoming travel to change their booking reference numbers, per CNA.

What happened in the Amadeus data breach?

An unauthorized party used valid login credentials for an Amadeus system account to read airline reservation records over roughly three years, from August 2023 to September 2026. Amadeus IT Group, based in Spain, runs the passenger service systems that many airlines use for reservations, ticketing and check-in, so one compromised account reached passengers of several carriers at once.

Cathay Pacific’s notice gives the clearest description of the method. Amadeus told Cathay on October 28, 2026 about “unauthorised access to travel reservation data in its systems by an unauthorised party using login credentials assigned to its system account.” Cathay describes Amadeus as a provider to “hundreds of airlines worldwide.”

According to ANA, as reported by Kyodo in The Mainichi, Amadeus detected the unauthorized access on September 24, 2026. The last access traces that Japan Airlines and ANA list are from September 23, 2026. Airlines were then told one by one: Korean Air on the night of October 20, Japan Airlines on October 23, and Cathay Pacific on October 28.

Amadeus’s own response, as passed on by the airlines, was to revoke the compromised credentials, reset the password and step up monitoring. ANA says “the compromised authentication credentials have already been revoked.” Cathay says Amadeus “has not identified evidence that the affected data has been misused.”

Which airlines are affected by the Amadeus breach?

Nine carriers have confirmed impact or been reported as affected as of October 31, 2026. Five of them have published numbers. Amadeus hasn’t said how many of its airline customers were hit. Reuters says Amadeus “did not respond to a question on how many airlines and customers’ data were affected.”

Counts are each airline’s own figures. Cathay counts bookings, not people, so the numbers can’t simply be added. Together, the published figures come to more than 180,000 customer records or bookings.

Lufthansa hasn’t commented. Bloomberg says Deutsche Lufthansa “did not immediately reply to a request for comment.” That matters because a separate October report from heise online (below) found many Lufthansa and Condor bookings in an exposed Amadeus system. No US or UK airline has said it was affected as of October 31.

What data was exposed, and what wasn’t?

For most affected travelers, the exposed data is a name, booking reference, flight date, route and cabin class. A smaller group, about 2% at JAL and about 4.5% at ANA, also had contact details, passport number, nationality and frequent flyer number exposed. No airline reports stolen card numbers, account passwords or payment data.

A booking reference sounds harmless, but it matters. At many airlines, a six-character booking code plus a surname is enough to open the “manage booking” page. Anyone holding both can see your itinerary and, depending on the airline, may be able to make changes. That’s the main reason to watch your upcoming bookings (see below).

Is this the same as the Amadeus flaw heise reported in October?

Amadeus hasn’t said, and no airline has linked the two. On October 13, 2026, the German tech site heise online reported that a heap dump (a memory snapshot) of an Amadeus Spring Boot application was reachable without a password. heise said it held access credentials and administrator passwords that allowed “read and write access to the global system.” The records heise checked included full names, dates of birth, booking codes, and contact, ID and passport data in plain text. heise said “a large part” concerned Lufthansa and Condor flights.

Amadeus told heise it had learned on September 21, 2026 of a “potential vulnerability” that “affected a display environment for travel bookings,” and that it had fixed it. When Reuters asked about the airline breach on October 30, Amadeus used the same wording: it said it had become aware “of a vulnerability affecting a travel booking display environment,” and that there are “no indications that the vulnerability has been exploited for ransomware purposes.”

So the dates line up. heise’s exposure was reported to Amadeus on September 21, the airlines’ access traces stop on September 23, and ANA says Amadeus detected the access on September 24. Amadeus’s wording to Reuters matches what it told heise. Still, no source confirms that the exposed credentials were the ones used against the airlines, so we treat the link as possible, not proven.

How do I know if I’m affected by the Amadeus breach?

You’re likely affected only if you booked with one of the airlines above between August 2023 and September 2026, and the airline contacts you. JAL says it has already emailed affected customers at the address on the booking. ANA and Cathay say they’ll contact affected customers directly. Star Flyer will do the same once its count is verified.

1. Check your booking history. Look for JAL, ANA, Cathay Pacific, Korean Air, Asiana, Jin Air, Star Flyer, Malaysia Airlines or Condor flights booked from August 2023 onward. If you booked through a travel agent or another airline and aren’t sure which system held your booking, ask the airline that operated the flight.
2. Look for the airline’s notice in your inbox, but verify it. A real notice won’t ask you to pay, log in through a link or send passport scans. If in doubt, find the notice on the airline’s own website instead.
3. Use the official helplines, not numbers in emails. JAL’s dedicated desk is +81-3-4332-7280 from outside Japan, 10:00 to 17:00 Japan time, Monday to Friday. Star Flyer’s call center is +81-93-512-7320. ANA and Cathay point customers to their normal contact channels.
4. Don’t expect a breach-checker site yet. No airline or Amadeus has published a lookup tool, and no public dataset has been confirmed as of October 31.

What should travelers do now?

Treat any message about your trip with suspicion, lock down your frequent flyer account, and keep an eye on upcoming bookings. Nobody has reported misuse of the data yet. But scammers who know your name, flight date and booking code can write very believable fake airline emails. Germany’s cyber agency, the BSI, told heise that phishing can follow a data leak after “a considerable delay.” It said messages about outstanding payments or early check-in need extra scrutiny as the travel date gets closer.

1. Never pay or “verify” from a link. Fake messages may ask you to pay a “fare difference,” confirm seats, claim a refund or upload a passport. Open the airline app or type the airline’s address yourself.
2. Change your frequent flyer password and turn on two-factor authentication. Passwords weren’t exposed, but frequent flyer numbers were for some people. A unique password plus an authenticator app is stronger than SMS codes. Our guide on whether SMS 2FA is safe explains the options.
3. Check your loyalty points balance and upcoming bookings. Look for changed contact details, new names on bookings or miles you didn’t spend, and call the airline if anything looks wrong.
4. Be wary of calls about your flight. If someone calls quoting your booking and asks for card details or a passport number, hang up and call the airline back on its official number.
5. Watch your phone too. If you’ve already tapped a suspicious link, our checklist on how to tell if your phone is hacked walks through the warning signs.
6. No airline has told customers to replace their passports. None of the notices we read recommends it. If your passport number was exposed and you’re worried, ask your country’s passport authority for advice.

Where to report scam messages in the US and UK

For more on how leaked contact details travel, see our Citizens Bank data breach explainer. It covers credit freezes and fraud alerts, which matter if more sensitive data turns up later.

Why did one vendor breach hit so many airlines?

Airlines outsource their core reservation systems, and Amadeus is one of the biggest providers. When one system account at the vendor is compromised, every airline whose records that account could see is exposed at once. That’s why the notices from Tokyo, Seoul, Hong Kong and Kuala Lumpur all describe the same incident and the same August 2023 to September 2026 window.

Two details stand out. First, the access ran for more than three years before Amadeus detected it on September 24, 2026, according to ANA. Second, the attacker didn’t need to break in. Cathay says the party used “login credentials assigned to its system account.” Long-lived service accounts with broad read access are a known weak spot, and this incident shows the scale of damage one of them can do.

Korean Air and Asiana said they had demanded that Amadeus strengthen its data protection and draw up measures to prevent a recurrence. “We will conduct thorough inspections of our contractors and further strengthen measures to protect customer information,” a Korean Air official told Seoul Economic Daily.

Amadeus breach timeline

What we don’t know yet

• How many airlines and passengers in total. Amadeus hasn’t published a count.
• Whose account it was and how the credentials were stolen. No airline or Amadeus has said.
• Whether the heise exposure and the airline breach are the same incident. The dates and Amadeus’s wording overlap, but nobody has confirmed it.
• Whether US or UK airlines are affected. None has said so as of October 31.
• Whether the data has been sold or leaked. Amadeus says it has found no evidence of misuse.

FAQ

What is the Amadeus data breach?

An unauthorized party used login credentials for an Amadeus system account to read airline reservation data between August 2023 and September 2026. Amadeus runs booking and check-in systems for many airlines, so passengers of several carriers were affected.

Which airlines were affected by the Amadeus breach?

As of November 4, 2026: Japan Airlines, ANA, Star Flyer, Cathay Pacific, Korean Air, Asiana, Jin Air, Malaysia Airlines and Singapore Airlines have confirmed impact, and Bloomberg reports Condor was affected. Amadeus hasn’t published a full list.

Were credit card numbers or passwords stolen?

No. Japan Airlines, ANA and Star Flyer say no credit card numbers or passwords were compromised. Cathay Pacific and Malaysia Airlines say there’s no evidence financial or payment information was accessed.

Were passport numbers exposed?

Yes, for a small share of customers. About 2,000 of JAL’s 92,000 affected customers and about 1,700 of ANA’s 37,800 had passport numbers and nationality exposed. Cathay says travel document details were potentially accessed in a smaller subset of bookings.

How do I know if my booking was affected?

The airline will contact you. JAL says it has already emailed affected customers, and ANA, Cathay Pacific and Star Flyer say they’ll contact them directly. Check any notice on the airline’s own website rather than trusting links in an email.

Should I cancel or change my flight?

No airline has advised it. Flights aren’t affected. Do check your upcoming bookings in the airline’s app for changes you didn’t make, and change your frequent flyer password.

Is the Amadeus breach linked to the heise report about Lufthansa and Condor?

It hasn’t been confirmed. heise reported an exposed Amadeus system on October 13, and Amadeus has described both issues as affecting a booking “display environment.” Amadeus hasn’t said whether they are the same incident.

Sources

• Airline notices: Japan Airlines (Oct 30, 2026), ANA (Oct 30, 2026), Cathay Pacific (Oct 30, 2026), Star Flyer (Oct 29, 2026), Malaysia Airlines
• News reports: Reuters via StreetInsider (Oct 30), Bloomberg via The Straits Times (Oct 30), The Business Times (Oct 30), Kyodo via The Mainichi (Oct 30), Seoul Economic Daily (Oct 23)
• heise online: Security vulnerability in flight booking system (Oct 13, 2026), BSI advice on Amadeus gaps (German, updated Oct 15, 2026)
• Reporting scams: NCSC: Report a scam email, Report Fraud (UK), FTC ReportFraud, IdentityTheft.gov