Major Software Provider That Manages Bookings For Hundreds of International Airlines Had a Data Breach For THREE Years - PYOK

Cathay Pacific has revealed it is among airlines affected by a major data breach in Amadeus systems, exposing information from 53,000 bookings between August 2023 and September 2026. The airline was informed of the breach on October 28, with Amadeus eventually detecting unauthorized access to its systems after more than three years of potential exposure.

Amadeus, one of the world's largest suppliers of airline technology solutions, provides a full-service passenger technology platform called Altéa that powers flight sales, booking management, check-in, and other critical airline operations. The breach has impacted multiple airlines that use this system.

In a statement, Cathay Pacific explained that in most cases, the accessed information included booking reference, passenger name, and flight details. In a smaller subset of cases, additional personal information including email and phone contacts, travel documents, and frequent flyer numbers were potentially accessed.

Multiple Airlines Affected

So far, five airlines have publicly confirmed they were caught up in the Amadeus data breach. Along with Cathay Pacific, Japan Airlines confirmed 92,000 passenger records were accessed, while ANA All Nippon Airways reported 37,800 passenger records were leaked. Korean Air and Germany's Condor are also confirmed victims, though neither has revealed the extent of information accessed.

The total number of affected passengers across all airlines approaches 200,000, making this one of the most significant breaches in aviation history. The breach occurred over an unusually long period, with unauthorized access spanning more than three years before detection.

Security Concerns

Airlines have been on high alert for potential cyber breaches since early 2025, when security experts warned that hackers like Scattered Spider (also known as Muddled Libra) were attempting to gain illegal access to airline databases through social engineering scams rather than technical exploits.

Cathay Pacific noted that one of Amadeus's main actions was to perform a password reset, suggesting the hackers may have used social engineering to trick IT support desks into providing legitimate login credentials. While no financial data was compromised, the breach creates significant phishing risks.

With access to booking data and passenger email addresses, hackers could craft convincing phishing emails that appear to come from legitimate airlines. These scams typically aim to install malware on victims' computers or redirect them to fake websites designed to steal additional personal information.

Previous Breaches

This incident follows another major breach affecting airlines through third-party vendor Salesforce. All affected airlines were using Salesforce's customer service management software, with criminals accessing passenger data from carriers including Air France, KLM Royal Dutch Airlines, and Qantas.

The fallout from the Salesforce breach at Qantas led to senior managers taking pay cuts in an attempt to regain passenger trust. Amadeus has since taken action to contain the current incident, and there is currently no evidence to suggest the data has been misused.