JAL, ANA, Cathay Pacific, Korean Air, Asiana and Malaysia Airlines are caught up in the Amadeus data breach. What each says was exposed, and what Amadeus has said.
Cover image: Cathay Pacific in-town check-in counters at Hong Kong Station (2019 file photo) — photo by N509FZ, CC BY-SA 4.0, via Wikimedia Commons.
Malaysia Airlines became the latest carrier this weekend to warn customers that booking data may have been exposed in the Amadeus data breach, joining Japan Airlines, ANA, Cathay Pacific, Korean Air and Asiana Airlines. Paddle Your Own Kanoo reports that Germany's Condor is affected too. Japan Airlines has published the largest figure so far, about 92,000 customers, against ANA's 37,800 customers and Cathay Pacific's 53,000 bookings.
The data sits in Amadeus systems that airlines use for reservations, ticketing and check-in. The Spanish vendor has not said how many airlines or travellers are involved.
Which airlines are affected by the Amadeus data breach?
The figures cannot be added together. JAL and ANA count customers, Cathay counts bookings, and the others have given no number.
| Airline | Figure given | Data exposed, per the airline | Told by Amadeus | Announced |
|---|---|---|---|---|
| JAL and Japan Transocean Air | About 92,000 customers | Booking reference, name, flight date, route, class; for about 2,000, also contact details, passport number, nationality, mileage number | 23 Oct | 28 Oct |
| ANA | About 37,800 customers | Name, reservation number, flight date, route, class; for about 1,700, also contact details, passport number, nationality, mileage number | 20 Oct | 29–30 Oct |
| Cathay Pacific | 53,000 bookings | Mostly booking reference, name, flight details; for a subset, contacts, travel document or frequent flyer number | 28 Oct | 30 Oct |
| Korean Air | Not disclosed | Booking reference numbers; other items under investigation | 20 Oct, 22:44 local | 23 Oct |
| Asiana Airlines | Not disclosed | Booking reference numbers; other items under investigation | 20 Oct, 22:49 local | 23 Oct |
| Malaysia Airlines | Not disclosed | Not disclosed | Not disclosed | 31 Oct–1 Nov |
| Condor | Not disclosed | Not disclosed | Not disclosed | No statement found; reported by Paddle Your Own Kanoo, 30 Oct |
Korean Air and Asiana, which merge on 17 December (see Korean Air's record quarter before the merger), both reported the incident to Korea's Personal Information Protection Commission, Aviation Wire said. ANA has also told AIRDO, Solaseed Air and StarFlyer, which use Amadeus through ANA, that their customers' data shows signs of access, it reported.
What data was exposed, and was payment data taken?
Passport numbers were exposed for about 3,700 travellers across JAL and ANA, according to ID Tech.
JAL and ANA say card numbers and passwords were not exposed. Cathay and Malaysia Airlines see no evidence that financial information was accessed.
JAL calls its window, 10 August 2023 to 23 September 2026, the period its records sat on the Amadeus system, and has not said when the access occurred, Aviation Wire reported.
What has Amadeus said about the breach?
Its website statement, dated 1 October by ID Tech, says Amadeus "became aware of a vulnerability affecting a travel booking display environment", found "no evidence that payment or financial data was accessed" and has taken measures to fix it.
The Korean airlines say the access appears to have used login credentials assigned to an Amadeus system account, Aviation Wire reported. ANA says those credentials have been disabled, and that Amadeus detected the access on 24 September but told ANA only on 20 October, after ANA asked. Cathay said a password reset was among Amadeus's main containment steps, according to Paddle Your Own Kanoo.
On 13 October heise online reported that a memory dump from an Amadeus application, reachable without authentication, held access credentials, and that booking records with names, booking codes and passport data could be retrieved, many for Lufthansa and Condor flights, plus hundreds of German travel agency office IDs. Amadeus told heise it learned on 21 September of a "potential vulnerability" that "affected a display environment for travel bookings".
No statement we reviewed links the airline notices to that exposure.
Amadeus's Altéa passenger platform has more than 130 airline customers, Paddle Your Own Kanoo says, and Amadeus also connects airlines with agents (see our GDS and airline ticketing explainer).
What should passengers and travel agents do?
JAL will contact affected customers, warns of fake emails, calls and websites posing as the JAL Group, and takes overseas calls on +81-3-4332-7280. ANA will contact its customers from the week of 2 November. Korean Air and Asiana warn against unfamiliar links, attachments and requests for personal details, and Malaysia Airlines against unsolicited requests for personal or financial information.
No notice we reviewed gives steps for travel agents. heise noted that security holes at IT suppliers regularly bring targeted phishing to the travel trade.
Frequently asked questions
Which airlines were affected by the Amadeus data breach?
As of 1 November 2026, Japan Airlines (with Japan Transocean Air), ANA, Cathay Pacific, Korean Air, Asiana Airlines and Malaysia Airlines have said customer data may have been exposed, and ANA has told AIRDO, Solaseed Air and StarFlyer their customers are affected too. Paddle Your Own Kanoo reports that Condor is also affected. Amadeus has published no list.
Was credit card data taken in the Amadeus breach?
Airlines that have addressed it say no. JAL and ANA say card numbers and passwords were not exposed, and Cathay Pacific and Malaysia Airlines see no evidence that financial information was accessed.
How will I know if my booking was affected?
Your airline should tell you. JAL and ANA say they will contact affected customers, and Korean Air and Asiana have emailed theirs. Several of the airlines warn against unexpected messages asking for personal or financial details.
Did the breach last three years?
That has not been established. Most notices cite August 2023 to September 2026, but JAL describes its window as the period its records were held on the Amadeus system, and has not said when the access happened. Korean Air says the exact timing is under investigation.
Sources
- Amadeus, Data and vulnerability statement
- Aviation Wire, JAL and JTA Amadeus notice (Japanese)
- Aviation Wire, Korean Air and Asiana Amadeus notices (Japanese)
- Aviation Wire, ANA Amadeus notice (Japanese)
- ID Tech, Amadeus breach exposes JAL and ANA passport numbers
- Paddle Your Own Kanoo, Major airline software provider had a data breach
- heise online, Security vulnerability in flight booking system
- Malay Mail, Malaysia Airlines warns of data exposure
