Key Highlights: Malaysia Airlines Joins Airlines Affected by Amadeus Cybersecurity Incident - FL360aero
Malaysia Airlines announced on October 31, 2026, that customer information processed through Amadeus may have been exposed following unauthorized access to the technology provider's systems.
The Malaysian national carrier confirmed that certain customer information processed through Amadeus may have been affected by unauthorized access to the technology provider's systems. The potential exposure covers a period between August 2023 and September 2026, spanning approximately three years.
Malaysia Airlines stressed that its own information technology infrastructure has not been compromised and that there is currently no evidence that customers' financial information has been accessed. The airline is working closely with Amadeus and other relevant parties to investigate the incident and establish the extent of the potential exposure.
Customer Information at Risk
Malaysia Airlines has not yet disclosed the number of potentially affected customers or identified the specific categories of information involved. However, the airline has confirmed that customer information processed through Amadeus during the affected period may have been exposed.
The distinction is important: the airline's announcement confirms a potential impact, not that every customer who booked during the three-year period has had their information accessed. Malaysia Airlines has also emphasised that its internal IT systems have not been compromised and there is currently no evidence of financial information being accessed.
The airline has advised customers to remain vigilant against suspicious emails, telephone calls and other unsolicited communications, particularly those requesting personal or financial information.
Global Airlines Affected
Malaysia Airlines is not an isolated case. The Amadeus incident has triggered security alerts across several major international airlines, highlighting the risks associated with shared reservation platforms.
Japan Airlines disclosed on October 30, 2026, that unauthorized access to Amadeus systems had potentially exposed reservation information belonging to approximately 92,000 customers of Japan Airlines and Japan Transocean Air. The airline confirmed that credit card numbers and passwords were not compromised.
Approximately 90,000 customers had reservation codes, names, flight dates, routes and travel classes potentially accessed.
Industry-Wide Concern
Cathay Pacific confirmed on October 30, 2026, that approximately 53,000 bookings were affected by unauthorized access to reservation information held by Amadeus. Similarly, All Nippon Airways reported that approximately 37,800 customers may have had reservation information accessed through the Amadeus passenger service system.
South Korean carriers Korean Air and Asiana Airlines also reported potential customer information exposure through Amadeus. Both airlines said there was no evidence that their own internal systems had been compromised.
The common factor across these incidents is that they involve the same third-party reservation technology provider, rather than separate confirmed breaches of each airline's internal IT infrastructure. This highlights a broader problem facing airlines: cybersecurity vulnerabilities within external technology providers can expose passenger information even when an airline's own systems remain secure.
Related
