Amadeus Data Breach: 38 Months of Airline Data [2026] - shattered.io

Malaysia Airlines informed customers that a cybersecurity incident at Amadeus, its third-party airline reservation technology provider, may have compromised certain customer information. The data in question was processed through Amadeus between August 2023 and September 2026, covering approximately 38 calendar months. The airline emphasized that its own IT systems remained secure during this period.

The incident, described by many as a data breach, is more accurately characterized as a vendor-side exposure. Amadeus identified a vulnerability in its travel booking display environment that made certain booking-display data accessible. Neither company has disclosed how many customers were affected or which specific data fields were involved.

The vulnerability explained

Amadeus characterized the issue as a flaw in its travel booking display environment—a system that shows reservation data to authorized parties including airline staff, agents, or customers retrieving bookings. The vulnerability potentially exposed information that the display function was designed to show, rather than raw database contents.

Certain booking-display data was accessible through the vulnerability. Although our investigations continue, we can confirm that there is no evidence that payment or financial data was accessed.

The admission that data was accessible differs from confirmation it was accessed, leaving open the possibility that information may have been retrieved without detection. Amadeus also noted there were no indications the vulnerability had been exploited for ransomware purposes.

What data was potentially exposed

While the specific categories of personal information remain unconfirmed, booking display environments typically contain passenger names, itineraries, travel dates, booking references, and potentially contact details and special service requests. Even without payment information, this data has value to criminals who could craft convincing phishing messages about schedule changes or refunds.

The absence of confirmed financial data access provides some reassurance, but the 38-month exposure window increases the potential impact. More bookings flowed through this vendor system during this period as airline traffic and online booking volumes grew, expanding the pool of potentially affected records.

Customer response and next steps

Malaysia Airlines advised customers to be vigilant about unsolicited communications that might reference their travel details. The airline is working closely with Amadeus and relevant parties to complete the investigation but has not provided a timeline for when more details might be disclosed.

For affected customers, the most immediate concern is potential phishing attacks using their booking information. The airline's guidance specifically targets this likely follow-on harm, though without knowing the exact data exposed, customers must remain cautious about any communication referencing their travel plans.