Qantas and major Asian airlines affected by Amadeus data breach - Beinsure

Qantas and several major Asian airlines have been affected by a cybersecurity breach at Amadeus, the Spanish travel technology company that provides reservation and booking services to airlines worldwide. The incident involved unauthorized access to an Amadeus system, potentially exposing passenger reservation records and booking information.

Amadeus contained the incident in September 2026. Qantas confirmed its own systems remain secure and has notified Australian cybersecurity authorities. The Australian airline is working with the technology provider to establish whether any of its passengers' booking information was compromised.

Financial data appears safe

Amadeus reported no evidence of access to payment or financial data. The company confirmed that certain booking-display data had been accessible to unauthorized parties. It has implemented security measures to address the vulnerability, reset compromised credentials and strengthened monitoring and detection systems.

Amadeus also reported no indications that the vulnerability had been exploited for ransomware attacks. The unauthorised access involved credentials assigned to an Amadeus system account. According to affected airlines, the exposure extended from August 2023 to September 2026, although the precise scope remains under investigation.

Thousands of customers affected

Cathay Pacific confirmed that approximately 53,000 bookings were affected. Most exposed records contained passenger names, booking references and flight details. A smaller number also included email addresses, telephone numbers, travel document information and frequent flyer numbers.

Japan Airlines and Japan Transocean Air reported approximately 92,000 affected customers. Of those, around 90,000 had basic reservation information exposed, while another 2,000 had additional personal information compromised, including passport numbers, nationality, contact details and frequent flyer information.

All Nippon Airways (ANA) separately confirmed that approximately 37,800 customers were affected, including 1,700 whose records contained additional personal information. Malaysia Airlines, Korean Air and Asiana Airlines have also reported exposure involving Amadeus reservation systems, although the total number of affected customers across all carriers remains unknown.

Airlines respond to breach

Japan Airlines has contacted affected customers, while Cathay Pacific is reviewing the compromised records before issuing individual notifications. Airlines have advised passengers to remain alert to suspicious emails, phone calls and websites requesting personal or financial information.

Despite the absence of confirmed payment data exposure, compromised booking references, travel itineraries and personal identifiers could be used in targeted phishing attempts or fraudulent communications impersonating airlines. Affected airlines reported that their own IT systems and flight operations remained unaffected.