Multiple airlines have reported unauthorized access to passenger data in systems operated by travel technology company Amadeus.
The exposed information in some cases included passport numbers and contact details.
According to a statement from Cathay Pacific, an unauthorized party accessed reservation data in Amadeus systems using credentials assigned to an Amadeus system account.
The access occurred between August 2023 and September 2026, according to disclosures from Japan Airlines and Cathay Pacific. Amadeus notified carriers of the breach between October 20 and October 28, based on dates provided by multiple airlines.
In a statement, Amadeus acknowledged a vulnerability affecting its travel booking display environment that made certain booking data accessible. The company said it had found no evidence that payment or financial information had been accessed.
Airlines disclose impact
Japan Airlines said approximately 92,000 customers of Japan Airlines and Japan Transocean Air were affected, including about 2,000 whose exposed information included additional personal details such as passport numbers.
All Nippon Airways (ANA) reported approximately 37,800 affected customers, including about 1,700 whose additional personal information may have been compromised. Cathay Pacific said approximately 53,000 bookings were affected.
Korean Air and Asiana Airlines also reported exposure of customer reservation numbers, while Malaysia Airlines said customer information may have been affected.
Qantas is investigating whether its bookings were impacted, according to a statement reported by Australian Aviation.
“Amadeus implemented measures to fix the vulnerability as well as enhanced monitoring and detection capabilities,” the company said. “We are in direct dialogue with our customers and authorities.”